Yubico Forum

Re: Dual usage Yubikey

2014-10-22T12:05:32+01:00

JH2007 wrote:

Would a two button Yubikey overcome the plugged in the back of a laptop dilemma?
No. Because if the average computer user can't see it then they are just fumbling around a large piece of equipment.

I would think that it is just a very small percentage of the users, that would be unable to have a Yubikey near their hand(s), and be unable to feel the difference between the location of button one and button two?
For example, for each one that knows the UBS is inconveniently placed, they could just get a USB extension chord and put the Yubikey in it, which most likely would let them place it in a convenient spot.

I fail to see how that concern could be used as an argument to dismiss the idea of two buttons alltogether.

If, in addition to having two buttons, one can be shaped round, and the other square, then that would give even further practical associations to which button has been used for which function.

The "shape" I am talking about is just the plastic "edge" around the metal button: It does not need to only be round. From a production/design point of view, it is dead simple to select an alternative, practical shape without affecting the quality or durability of the Yubikey at all.

Statistics: Posted by Nomadus — Wed Oct 22, 2014 12:05 pm

Re: Dual usage Yubikey

2014-10-21T17:20:01+01:00

I agree! This would make the Yubikey much more user friendly and cost effective. As we speak, 50$ for the NEO is super expensive for the "normal" user. Much less attractive is you need 2 AND a VIP. I know many that don't go the Yubi way because of the price.

Also, I think there should be a fifth (and sixth if 2 buttons) slot not linked to a button that would be home to a HMAC config.
When a challenge would require a button press, then button 1 for slot 5 and button 2 for slot 6.
This way, HMAC is not wasting useful button-triggered slots.

Statistics: Posted by Morphlin — Tue Oct 21, 2014 5:20 pm

Re: Dual usage Yubikey

2014-10-17T11:42:25+01:00

Has there been any serious considerations in Yubico related to a two-button alternative?

It is very awkward to have potential clients becoming very interested in Yubikeys only to realize that if they want to "go down this road" and hence make a strategic decision that the Yubikey(s) should be their preferred 2FA/U2F device, then they must buy several yubikeys as one would not provide enough options. Very often, it is the need to have a) OTP from Yubico server, b) Static password, c) VIP (for example to secure your Paypal account), and now recently: d) NEO.

Certainly a two-button design that would include a total of 4 variants would solve this.

One can make up small tricks like something that can be felt, for example having the first button round, and the second frame around the button area square, so that when not looking at it, one can feel the difference.

Think about all the old people who have even greater problems with passwords. They are in need of tactile asociations to help them remember where is which function. A normal confusion would be "did I put the VIP on the first press of the first button, or the first press of the second button?". A tactile association like the square that can be physically felt, would help add one more association to it, and then easier to remember, and less confusion.

(Re: Passwords/logins to the forums here:
I think it is high time for the yubico forums to be accessible on HTTPS, so that passwords are secured regardless of using OTP or not. Strange that a company like this dares to give such an impression while being a security focused company.)

Statistics: Posted by Nomadus — Fri Oct 17, 2014 11:42 am

Re: Dual usage Yubikey

2014-10-14T08:15:30+01:00

You can disable Yubikey at logon, at your own risk, in the user control panel

The feature of the Yubikey and software are the same on any operating system windows mac linux.

Statistics: Posted by Tom — Tue Oct 14, 2014 8:15 am

Re: Dual usage Yubikey

2014-10-13T23:36:59+01:00

Hi

Thank you for the reply.

I hope you actually see this message after all the junk that was posted in this thread.

I haven't tried the Windows tool, but I guess that is what the screenshot is of.

Is it possible to do it using the MAC personalisation key?

Also, an unrelated question, is there a way to join and or use this forum without the OTP feature enabled on my Yubikey? I would like to set static passwords on both slots and it looks like that will log me out of the forum.

HC

Statistics: Posted by hcharlie — Mon Oct 13, 2014 11:36 pm

Re: Dual usage Yubikey

2009-04-15T03:18:24+01:00

Quote:

I've spent some time making some prototypes.

Once I animated the original two button design I could visualize in my mind, how pressing one, or the other, or both, can allow a two button operate as a 3 button design. But by that time you'd emailed the desire to use the same form factor which I understood as the same outer dimensions and basic layout (1 usb connector, 1 button, 1 keyring hole).

With the double-tapping... go to some local workplaces (offices, retail, workshops) and see how people use their mouse.
Personally I've found interesting to observe how some people use the mouse.
Sounds a bit like you've come to the same realization on all the timings, where if they all can't be customized then don't bother designing anything beyond the current design (1 button 1 OTP) yubikey.
Yes I agree, the intuitive way really is to press the button until the OTP output pops-out.

Quote:

I believe the default option shall be quick and highly intuitive (i.e. push until you get the OTP) whereas getting access to the second function...

There's that timing issue again. Originally that long key press was to ensure fewer mistakes from a casual or accidental keypress.
Hmm, wouldn't a triple tap take about the same time or less then the current press and hold?
Also the triple tap could keep it just as simple while ensuring fewer mistakes.
True some people would be annoyed, but perhaps the personalization software could toggle between triple and double tapping?

PS. binaryhackerman has brought up a point that I made awhile ago. Will Yubico be keeping the current economic/business grade Yubikey, and also offering a more advanced ($$$) feature enriched Yubikey?
I have to ask because quite frankly I see the current Yubikey as a solid and economic solution to small business inventory/POS/DB management control.

Also the "multicolored bumpers" could be made like any automotive trim panel retainer and snap into place, to avoiding epoxies and their shelf life. A similar bumper should be fairly easy to design for the current Yubikey, but it'll really be a bumper on the back that ends up making the keyring hole smaller.

Statistics: Posted by JH2007 — Wed Apr 15, 2009 3:18 am

Re: Dual usage Yubikey

2009-04-06T01:18:30+01:00

I would love to have two designs in production (a one button for non tech users, and a two button for the geeks).
I do however like the idea of timing for the differentiation as it could be implemented on current hardware. I agree that the default OTP mode should be to hold until the light goes off and output starts as this would not require any re-training if you only want to continue with the current feature set. you would only have to worry if you wanted to take advantage of the second OTP feature... which could fit in one of two cases a "tap" or an "extended hold" ~5 seconds where the light could blink twice and output... I haven't decided which i would like better.

one must also realize that you will never be able to get to a point where everyone is happy with the design.

I also like the idea of multicolored bumpers or frames that could be epoxied on as i have been searching for a way to differentiate several keys for different uses.

Statistics: Posted by binaryhackerman — Mon Apr 06, 2009 1:18 am

Re: Dual usage Yubikey

2009-03-30T01:32:20+01:00

I've spent some time making some prototypes. As usual, things get a bit different when you try it IRL...

Changing the sensitivity of the sensor allows some fairly precise double-tapping and it works pretty nice. But as you guys pointed out, inserting the Yubikey into a really worn USB port of a laptop makes double-tapping somewhat flimsy. I've not made up my personal mind if this is a show-stopper.

Implementing the short vs. long press exposed another issue that I really forgot in the first place - for the short press you need to remove the finger to release the OTP. I believe this can be a bit confusing as the intuitive way is to press the button until the OTP output begins to show up. If you are aware about the behavior it works nice.

I believe the default option shall be quick and highly inituitive (i.e. push until you get the OTP) wheras getting access to the second function could require a few seconds of training. The second option above could maybe be pretty okay after all if the thershold is set reasonably long. If you don't get the OTP within two seconds when you push, you're pretty likely to give up. Then you'll get it and hopefully you learn.

Just a few open thoughts. I'll try a slight variation of the above and return if it seems to make sense.

Regards,

JakobE
Hardware- and firmware guy @ Yubico

Statistics: Posted by Jakob — Mon Mar 30, 2009 1:32 am

Re: Dual usage Yubikey

2009-03-24T04:21:03+01:00

Thank you Jakob. I think that all concepts at this point will have pros and cons.
Let me brainstorm here a moment:

I admit I'd forgotten about colour-blindness with the two designs A2, and J4.
After some consultation I can state that if you stick to using Green and Blue combo, or using a Red and Yellow combination, then you'll be fine.
Record their operation, then grayscale the recording and ensure that the two colours are distinctly different shades of gray for maximum compatibility.
Or simply consult a colour-blindness medical specialist, because this field is well researched and documented.

Morse Code?
The idea of tapping some cryptic sequence into a yubikey that's plugged into the back of a computer or laptop, is just as useful as indicator lights...
I don't think the average computer user would want to tap-tap-tap-tap-tap their way through passwords...
This is especially true for persons with fine motor control difficulties, and I believe they outnumber colour blind persons.

So how about adding a micro-speaker or piezoelectric/buzzer?
Personally I'm tone deaf, so the speaker would be of no use to me. Except perhaps in the duration, but honestly, it'll just annoy me.

So who needs what feature?
- Hearing impaired or deaf persons may prefer: lights on, and sounds off.
- Visually impaired or blind persons may prefer: lights off, and sounds on.
- Deaf+Blind persons would require Braille cells, which are actually a fairly good solution to this entire problem, but they are very expensive, very bulky, and mechanical.

Would a two button Yubikey overcome the plugged in the back of a laptop dilemma?
No. Because if the average computer user can't see it then they are just fumbling around a large piece of equipment.
And the laptops I've handled in the past ~6 years don't present me with the USB on the back issue...
So perhaps Yubico should simply sell a generic USB gender swapping extension cables like the 3foot long ones sold at (dollar stores) for $1.00 CDN ?
http://megacomputer.ca/product_info.php ... cts_id=132

This is turning out like that Jerry Sienfeild episode where he thinks back to every girl he dated and how he found something wrong with each of them.

Summary:
So a Yubikey with a speaker and two Complementary prime colours for light-indicators.
Both sound and lights working as indicators and either/both can be toggled on/off may be the best solution.
The personalization software should toggle the action between a tapping, versus a hold and let-go at certain indicator lights/sounds.
I'd say that the timings themselves must all be 100% changeable through the personalization software and let the customer decide.

But how much will the hardware for such a beast cost?
It is exactly like having two or more standard Yubikeys in one package, and I assume the Economic Standard Yubikey will be still available. Especially for first time users and cost-minded businesses.

Failing all of the above, I'll stay with the current version of the Standard Yubikey which is perfect for everyday businesses-related work/database/inventory/etc... usage.

Statistics: Posted by JH2007 — Tue Mar 24, 2009 4:21 am

Re: Dual usage Yubikey

2009-03-23T02:10:16+01:00

Thanks all for great input. Cool with the sample designs and implementations.

Personally, I am slightly sceptical to the concept of making too much use of the indicator lights, independent if this means adding more than the current one or just adding different patterns of flashing etc. In the case the Yubikey is inserted at a slightly awkward location, or take a pretty common case - in the back of a laptop. Reaching with the finger is okay but checking out lights is a different game. Multi-colored indicator lights typically attracts bad feedback from color blind people.

But thanks - We're working on a few sample implementations as I guess the best thing is to try it out in a real setting. We'll return when the time is ready to try it out...

Regards,

JakobE
Hardware- and firmware guy @ Yubico

Statistics: Posted by Jakob — Mon Mar 23, 2009 2:10 am

Re: Dual usage Yubikey

2009-03-22T05:50:50+01:00

Thank you dsaint.
Personally I feel that the default plus 3 indicator lights would be sufficient.
But the designs are just concepts and as you mentioned it is the underlying engineering and costs that are often a determining factor.

I had thought of the light colours pulsing versus steady state for mode/password indicators but this is something that seems to really confuse the non-geeks/IT.

You know, it didn't start as "product design" just simple creations to get something that will work.
Basically, I've been looking at using Yubikey as Inventory control and POS (Point of Sale) for a small business.
But the recipients are not techno-geeks or IT-pros...
So While showing many of them the Yubikey I often heard 2 comments.
What happens if I loose it? and How can I put my password on it?
The finer points of the Yubikey, DB and software, and all the security a Yubikey represents seems lost on everyone there.
So I started sketching several designs, the first was a two button Yubikey that I emailed off to Jakob who express a desire for same formfactor one button designs.
I've dozens of designs not worth posting because of serious design flaws or the dreadful confusion they will create (ie. design L).

In brief: I kept sketching designs and seeing until I had some that seemed to not confuse the people I want to use the Yubikeys with.

I almost forgot, only the F, M, and N series was two button design, all the others ended up as just ergonomic designs that people seemed comfortable with.

Statistics: Posted by JH2007 — Sun Mar 22, 2009 5:50 am

Re: Dual usage Yubikey

2009-03-22T01:05:18+01:00

Hi:

This is some serious online product design, permit me to add my two cents to the design process.

I like the multiple buttons, but I think we can implement everything with a single button.

We have a design with 4 or 5 indicator lights, why not use the 4 indicator lights and implement a binary or quasi-binary type sequencing.
Reserve the 1111 (all on) for POST of the key and 0000 (all off) for the default.
Use the one button as a toggle, press for 5-8 seconds to enter toggle mode where the key will sequence slowly through the options, press the button once again when you get to the one you are working with. The key would then signal by flashing the 1111 twice and then indicate the mode selected.
Press the button 10+ seconds and reset the key to the default yubico config 0000. Other resets can possibly be made, perhaps a reset of all but the default code.
The key can then have the default plus up to 13 additional operational modes ( if the electronics can allow that many).

We could use 3 indicator lights, with 6 modes or a 2 indicator with 2 modes in addition to the default.

Yes, please let the key be able to remember the last setting, let this be an option when the key is programmed by the user, either to keep the last mode or always go back to default. I should think that the default operation without any user programming should be to not toggle; we therefore remove any confusion with users who want to keep it simple.

It is probably cheaper to design the 4 button and produce in bulk, but, I suspect that most people will only need the 2 or 3 light, only uber-geeks would want or need a 4. Hence we might want to sell a 3 as a compromise.

Statistics: Posted by dsaint — Sun Mar 22, 2009 1:05 am

Re: Dual usage Yubikey

2009-03-20T03:20:39+01:00

I forgot to make note of D3 (as static image only) it simply shows 4 holes where the rubber/plastic "bumpers" could be attached by the end user.
I'd suggest a Yubikey could come with say 3-5 basic colours, and Yubico could retail an Accessory Kit with say a dozen+ other colours.
Of course the parts could be glued on, melt together, riveted, bolted, etc...
but sometimes it's just best to let the customer put the final touches on.

I was thinking of a thin plastic "bumper", one on each side.
This would also allow a person to put together more than one colour.

I'd guess that letting the customer put the "bumpers" on, would be more economical too.

Statistics: Posted by JH2007 — Fri Mar 20, 2009 3:20 am

Re: Dual usage Yubikey

2009-03-20T03:52:56+01:00

I hope I'm not too late to this discussion.
Well Jakob I slept on it and a month later, I came full circle to the same form factor (see design A2).

"Other ideas?"
Yes I have a few, see some concepts animated here.
http://www.execulink.com/~jhewitt/forms ... twork.html

Several designs are only as rough sketches, penciled notes, and observations that aren't worth even adding to the page.
Regardless, let me know your thoughts Jakob.

I can provide more info of my investigations and elaborate. (Just not sure if you'll find any of it useful.)

PS. The "two button Yubikey" would offer Alternative 4:
- Button 1 -> trigger OTP 1
- Button 2 -> trigger OTP 2
- Button 1+2 -> trigger OTP 3
- Button 1+doubletap2 -> trigger OTP 4
- Button 2+doubletap1 -> trigger OTP 5

Statistics: Posted by JH2007 — Fri Mar 20, 2009 3:09 am

Re: Dual usage Yubikey

2009-03-10T09:04:17+01:00

iipee wrote:

Alternative 2: Some times Yubikey is not very steady when inserted. I believe double tapping isn't always easy

As far as I can tell, Yubikeys will never ever be steady in any standard USB port - just by design. "Usual" USB plugs have this metal casing which the Yubikey lacks - this metal frame is just meant to sabilize and lock the connection. As the Yubikey lacks this frame and is just half as thick as the USB plug is designed for, it will always be a bit wobbly. Don't get me wrong though, the data-connection is fine, because the contact on the plug-side are flexible.

BTT:
#1: 0.3 seconds as the lower threashhold could be a bit low and thus may allow accidental submission of OTPs. Still, I think this is the most promising way, once you have the timing. Currently I leave my finger on the key until I can see it typing - which I shouldn't do if I configure OTP2 to be the Static one.

#2: This seems to be the most intuitive way to go - but still, there is the opportunity for accidental OTPs as 'taps' are very short and the Yubikey has to be quite sensitive to register them.

#3: I think, this is the most compley solution as it can hardly be operated blindly. Depending on where your Yubikey is plugged in, it can be troublesome to determine in which mode the key is right now.
One additional thought: If you switch modes, you probably want to emit an OTP in the new mode, so why not say "Holding the button for 3 seconds toggles modes and emits an OTP in the new mode".

Statistics: Posted by Kamikaze28 — Tue Mar 10, 2009 9:04 am