Yubico Forum

Re: How does auto-navigation work technically? (from sebastian)

2009-10-16T21:47:03+01:00

pilot wrote:

Yes. I believe you are right. I programmed my key to achieve plug in to log in to MashedLife.com to make using Mashed Life even easier.

But I can't do plug in to log in to Yubico forum at:

ucp.php?mode=login?otp=......

Any tips? Is it the problem of the forum or the key???

If plug in to login to blog in one shot, that will be REALLY COOL.

Hi, pilot, what do you really mean? I thought the question is that can you program the auto-navigation URL to a different URL other than Mashed Life ???

Is there any protection about who can re-program the URL? If there is no password protection of the authority, that is risky business.

Statistics: Posted by Robert Howard — Fri Oct 16, 2009 9:47 pm

Re: How does auto-navigation work technically? (from sebastian)

2009-01-14T03:55:51+01:00

I must admit I used the U3 Uninstall and never considered the Win key a threat.
Simply because the Win key seemed to be a physical access security issue.
(Versus a software (worm/virus/trojan) type threat.)

Seeing the point you made Dick.
It's time to rethink the security layers & computer hardware again.

Hmmm, I've heard good things about a program called Sandboxie but I haven't tried it yet.

Statistics: Posted by JH2007 — Wed Jan 14, 2009 3:55 am

Re: How does auto-navigation work technically? (from sebastian)

2009-01-13T20:15:46+01:00

Thanks, JakobE.

That's exactly what I would like to do. I agree that there are some potential problems with this feature. Perhaps I'm paranoid, but I find that feature a bit of a concern from a security point of view since it could be used for something other than directing a browser to a web page. I realize that someone would have to program the Yubikey to do that, but envision at least the theoretical possibility that a malware script could reprogram the Yubikey to do something undesirable which could then occur on each machine on which I used the Yubikey.

I understand from another thread that there's a more user friendly configuration utility in the works and will probably await its release before messing with this.

DH2007,

I appreciate the info, but don't really want to completely disable the Win key, merely the Win+R combination. Looks like I'd have to use something like a simple AutoHotkey script to do that. Now that I know that I can reprogram the Yubikey to remove the auto-navigation without interfering with the OTP function, I can do it that way and not have to fiddle with the key mapping.

Dick

Statistics: Posted by Dick — Tue Jan 13, 2009 8:15 pm

Re: How does auto-navigation work technically? (from sebastian)

2009-01-13T16:43:14+01:00

Oops my bad, you are correct.
It does 100% work without the U3 autorun.

Hmm, looks like there's a similar command for KDE & GNOME = Alt+F2
Perhaps it'll work with "Go to Browser" Cmd+L for Mac OS, if Safari/FF3 is already running?
http://en.wikipedia.org/wiki/Table_of_k ... _shortcuts

Here's three ways to Disable or control Winkey on keyboard (plus there's TweakUI)

How to Disable Winkey on keyboard:
(Formerly Q216893, Now uses Keywords: kbenv kbinfo KB216893)
http://support.microsoft.com/kb/216893

Fully control the keyboard with "I Hate This Key Deluxe Edition":
http://www.bytegems.com/ihatethiskeydeluxe.shtml

Another how to Disable Winkey on keyboard pre-Vista solution:
http://www.windowsnetworking.com/kbase/ ... board.html

More info about the Win Key:
http://en.wikipedia.org/wiki/Windows_key

Statistics: Posted by JH2007 — Tue Jan 13, 2009 4:43 pm

Re: How does auto-navigation work technically? (from sebastian)

2009-01-13T13:04:04+01:00

You're right - it does not work by the means of the autorun feature but rather that a WIN+R + string is sent.

It is a different configuration item so yes - it can be wiped without affecting the OTP generation settings.

But as this is an unofficial feature of the Yubikey (there are quite a few issues with it), we don't have a tool for it. You need to use the configuration API and write a blank string to SLOT_NAV (2).

Regards,

JakobE
Hardware- and firmware guy @ Yubico

Statistics: Posted by Jakob — Tue Jan 13, 2009 1:04 pm

Re: How does auto-navigation work technically? (from sebastian)

2009-01-13T08:01:16+01:00

Unless I'm missing something, the auto-navigation isn't dependent on the autorun function nor USB device characteristics, but rather on the fact that a Yubikey set up for auto-navigation sends a Win+R and then keystrokes for a URL which results in opening the designated browser and navigating to the URL. At least that's the way that it's done on the MashedLife Yubikey which, when you plug it in, takes you to that website and enters your Yubikey generated OTP.

I know that I can do some key redirection to kill the Win+R function, but was wondering if I could reprogram the Yubikey to remove the auto-navigation without completely wiping its OTP capability.

Dick

Statistics: Posted by Dick — Tue Jan 13, 2009 8:01 am

Re: How does auto-navigation work technically? (from sebastian)

2009-01-13T07:20:00+01:00

ATTN: always
If your working in the corporate or scholastic field then you should know how to kill the U3.

Go here to uninstall the autorun U3 Launchpad.
http://u3.com/uninstall/

Now here's a heads up for all, the next U3 headache is called StartKey (formerly: KeyChain)...
http://www.u3-info.com/sandisk/microsof ... eplacement
http://www.everythingusb.com/microsoft- ... 14376.html

Reference
http://en.wikipedia.org/wiki/U3

Edit: PS. Remove U3 at own headaches/problems, but I'd just use SandBoxie.

Statistics: Posted by JH2007 — Tue Jan 13, 2009 7:20 am

Re: How does auto-navigation work technically? (from sebastian)

2009-01-11T06:55:52+01:00

Is there a way to turn off the auto navigation without losing the OTP capabilities of the Yubikey? I assume that I could do it by reprogramming to a static PW, but can I do it without doing that?

Dick

Statistics: Posted by Dick — Sun Jan 11, 2009 6:55 am

Re: How does auto-navigation work technically? (from sebastian)

2008-07-19T08:29:46+01:00

I beleive it needs to be sorted out very explicitly in order to avoid any misconceptions. Please find some "axioms" listed below:

a) The Yubikey identifies itself as a HID device (HID = Human Interface Device, i.e. Mouse, Keyboard, Joystick etc) only.

b) Although the form factor reminds of an USB memory stick, there are no possibilities whatsoever for it to work as a mass-storage device, even less for it to expose a file system. There are no secret tweaks or smart hacks that could change this. Nothing, nada, nil - period.

c) The autorun feature offered for mass-storage devices, such as a CD requires the USB mass-storage class and a file system. There is nothing like that in the Yubikey.

d) As there is no file system, the device CANNOT spread viruses or trojans

e) The auto navigation function is just an automated keyboard input, just like if someone would add a second keyboard and type in the same information.

f) There are organizations that blocks the usage of USB memory sticks. That typically involves a short-circuit of the USB mass-storage driver and that does not affect the Yubikey - it will still work even if the mass-storage driver is gone.

g) Killing the HID driver would also kill the ability to attach a mouse or an external keyboard. I cannot see anyone wanting to do this.

Regards,

JakobE
Hardware- and firmware guy @ Yubico

Statistics: Posted by Jakob — Sat Jul 19, 2008 8:29 am

Re: How does auto-navigation work technically? (from sebastian)

2008-07-03T09:49:08+01:00

always wrote:

So: in reality, a Yubikey is a executable program. The user has *no way* of knowing whether
a script executes when you first insert the key.

With a CD or DVD, the user can reasonably expect autorun. With an authentication device, no.

This is a tremendous obstacle to overcome for corporate deployment.

I don't agree that is true. The yubikey doesn't contain any programs. Corporates can and sometimes already do have software that prevents employees from inserting USB memory sticks that can spread trojans or similar.

Restricting USB access to USB keyboards seems less useful, the employee will not be able to connect any normal keyboard to her laptop when she's travelling and so on.

So it is possible to exclude USB memory sticks but enable the yubikey to work.

I do agree it needs to be discussed with each customer. If they have a policy of physically destroying all USB outlets on machines, they will need to change their policies in order to use the yubikey.

/Simon

Statistics: Posted by Simon — Thu Jul 03, 2008 9:49 am

Re: How does auto-navigation work technically? (from sebastian)

2008-07-02T16:17:50+01:00

Statistics: Posted by always — Wed Jul 02, 2008 4:17 pm

Re: How does auto-navigation work technically? (from sebastian)

2008-06-25T08:16:23+01:00

always wrote:

How do you prevent someone from programming the equivalence of "rm -rf /"?

Having a token in effect execute arbitrary commands upon insertion is scary, since there is no reasonable way to detect and prevent it... or is there?

The intention is that only the yubikey owner can do this programming, and he can type 'rm -rf /' on the machines he access anyway.

Or more detailed, only the person that knows the programming password can do this programming. We are changing our process so that all yubikeys that we ship have a programming password set from factory. Right now, all keys are open to re-programming without a password.

/Simon

Statistics: Posted by Simon — Wed Jun 25, 2008 8:16 am

Re: How does auto-navigation work technically? (from sebastian)

2008-06-20T20:33:28+01:00

Statistics: Posted by always — Fri Jun 20, 2008 8:33 pm

Re: How does auto-navigation work technically? (from sebastian)

2008-06-13T06:46:40+01:00

Auto navigation works by the means of sending Win-R as a series of keystrokes. Given that the key is programmed with an URL in the form of http://xxx, Windows will launch the current registered browser (which does not need to be IE) and navigate to that URL. Optionally, an OTP can be automatically appended to the URL, allowing direct authentication, i.e. http://www.mysite.com/login?otp=clefcei ... bjeevvkdtg

Making it this way makes it a Windows specific feature. Maybe there is a Mac shortcut for doing the same, but then it would be a Mac specific feature.

Furthermore, this feature also requires configuration of the keyboard layout into the Yubikey. This means that if a key that is configured to work on a US keyboard is brought to France, it won't work.

It is a pretty cool function, but to me these issues are somewhat a turn-off...

The configuration flag ykFLAG_SEND_REF is used to prefix the OTP with the reference modhex string cbdefghijklnrtuv. This feature was added if there would be any problems with any keyboard layout that did not fit well with the modhex scheme. The server would then simply use the reference prefix string to make proper substitution of the characters in the OTP string. AFAIK, it seems like this feature is not needed.

Regards,

JakobE
Hardware- and firmware guy @ Yubico

Statistics: Posted by Jakob — Fri Jun 13, 2008 6:46 am

How does auto-navigation work technically? (from sebastian)

2008-06-12T21:15:58+01:00

WHY does that feature only work in windows?

What is the ykFLAG_SEND_REF for any configuration flag? What does it do?

What do you mean with "first part" and "second part" regarding the ykFLAG_APPEND settings?

Statistics: Posted by paul — Thu Jun 12, 2008 9:15 pm