Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 7:27 pm

All times are UTC + 1 hour




Post new topic Reply to topic  [ 10 posts ] 
Author Message
PostPosted: Wed Jun 18, 2008 7:05 pm 
Offline

Joined: Wed Jun 18, 2008 6:51 pm
Posts: 19
Hi,

Just got my Yubikeys and playing around at the moment. First thing I notice is that inserting the Yubikey in a Mac Mini (OSX 10.5.3) causes the keyboard setup assistant to appear. This attempts to identify the new 'keyboard' and asks me to press a key. I can just click 'continue' and ignore the assistant but this will soon become a drag. Anyone else had this and managed to stop it appearing?

Thanks.

--
Patrick


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

PostPosted: Wed Jun 18, 2008 9:08 pm 
Offline
Site Admin
Site Admin

Joined: Wed May 28, 2008 7:04 pm
Posts: 263
Location: Yubico base camp in Sweden - Now in Palo Alto
We've spent some time drilling into this issue and the following findings have been noticed:

1. Attaching an original Apple USB keyboard works straight away without any identification dialog.

2. A "Microsoft Comfort Keyboard", which claims to be "MacOS X compatible" brings up the identification dialog, just like with the Yubikey

3. A noname $10 "China" USB keyboard without any claims whatsoever causes exactly the same to happen

4. Spoofing the Yubikey's USB Vendor ID (VID) to 0x5ac (Apple Computer, Inc) and the USB Product ID (PID) to 0x221 (Apple USB MB110S/A keyboard) takes the question away. Most likely, Apple won't like if we spoof their IDs, but we just did it for the sake of testing :)

5. A non-Apple keyboard make the key "Change Keyboard Type..." button to appear under the System Profiler.

6. Spoofing the VID to be 0x5ac (Apple inc) of the device makes the button to disappear.

7. Analyzing the USB traffic from enummeration and onwards does not reveal anything specific for Apple keyboard vs. the non-Apple one.


These findings leads into the conclusion that the Mac seems to accept Apple keyboards based on the Apple VID only. All other VIDs requires you to identify your keyboard by pressing the key right to the left shift. Spoofing with Apple's VID and different random PIDs seems to be accepted as well.


This distills into our recommendation:

- When the Yubikey is inserted for the first time, the OS will ask you to identify your USB keyboard. This occurs for non-Apple proprietary USB keyboards.

- The dialog says "Your keyboard cannot be identified and will not be usable until it is identified. To identify this keyboard click Continue"

- Just kill the dialog and the Yubikey works straight away.

- Alternatively, press Continue and when the "Identifying your keyboard" dialog appears, press the Yubikey key. A message says that the keyboard cannot be identified. Ignore this and just fill in the keyboard type. Select ANSI and it all works fine.

- This question just appears once. The OS seems to remember your settings even if the dialog is clicked away.


A slight annoyance, I agreee. But hopefully something we can live with.


Any input in this issue is of course accepted

Regards,

JakobE
Hardware- and firmware guy @ Yubico


Top
 Profile  
Reply with quote  
PostPosted: Wed Jun 18, 2008 9:40 pm 
Offline

Joined: Wed Jun 18, 2008 6:51 pm
Posts: 19
Hey, thanks for the quick and detailed response. Its not really a problem, but you do have to be logged in as an admin user for the settings to stick. I wasn't doing this initially, and kept getting the dialog every time I inserted my key.


--
Patrick


Top
 Profile  
Reply with quote  
PostPosted: Thu Jun 19, 2008 1:35 am 
Offline

Joined: Fri Jun 06, 2008 5:56 pm
Posts: 9
This guide is very helpful!

mac_kb/

Cheers
8-)


Top
 Profile  
Reply with quote  
PostPosted: Thu Jun 19, 2008 9:53 am 
Offline
Site Admin
Site Admin

Joined: Tue May 06, 2008 7:22 pm
Posts: 151
Does anyone know where Mac OS X stores the information about the inserted keyboard? It must have a registry or similar where it remembers that it has asked the "identify keyboard" question for the yubikey. Possibly we could ask Apple to add the Yubikey to an automatic white-list. Alternatively, we can write a small Mac OS X application that sets the registry the right way directly.

Other ideas are welcome.

/Simon


Top
 Profile  
Reply with quote  
PostPosted: Thu Jun 19, 2008 10:29 pm 
Offline

Joined: Mon Jun 09, 2008 4:40 pm
Posts: 5
Location: Cincinnati, OH
Simon wrote:
Does anyone know where Mac OS X stores the information about the inserted keyboard? It must have a registry or similar where it remembers that it has asked the "identify keyboard" question for the yubikey.


I don't really know what sort of things can be stored in there, but there is a keyboard "plist" file in a directory (sorry... the word is "folder" for you Mac users :roll: ) somewhere. I think the folder name is "Preferences", but I'm not quite sure where it lives.

I'll try to dig into a co-workers Mac tomorrow and get back with the specifics.

_________________
--
Greg Estep


Top
 Profile  
Reply with quote  
PostPosted: Fri Jun 20, 2008 5:22 pm 
Offline

Joined: Mon Jun 09, 2008 4:40 pm
Posts: 5
Location: Cincinnati, OH
Greg wrote:
I'll try to dig into a co-workers Mac tomorrow and get back with the specifics.


The file is /Library/Preferences/com.apple.keyboardtype.plist

When I started the file didn't exist. I then inserted a YubiKey, and went through the keyboard assistant (see mac_kb/). The file was created with the following contents.

Code:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>keyboardtype</key>
<dict>
<key>16-4176-0</key>
<integer>40</integer>
</dict>
</dict>
</plist>

_________________
--
Greg Estep


Top
 Profile  
Reply with quote  
PostPosted: Sat Jun 21, 2008 3:35 am 
Offline

Joined: Fri May 30, 2008 5:32 am
Posts: 19
Location: Austin, TX USA
This command will add the Yubikey keyboard entry to that plist file. If the plist file does not already exist, the command will create it:
Code:
sudo defaults write /Library/Preferences/com.apple.keyboardtype "keyboardtype" -dict-add "16-4176-0" -int 40

If you manage a lot of Macs then you can just push that command out to them with Apple Remote Desktop and then your users won't be prompted when they insert their Yubikey.

I have only tested this command out on MacOS X 10.5.3. It may or may not work on 10.4 Tiger installs.


Top
 Profile  
Reply with quote  
PostPosted: Wed Jun 25, 2008 8:23 am 
Offline
Site Admin
Site Admin

Joined: Tue May 06, 2008 7:22 pm
Posts: 151
Greg, James, thank you very much for finding this out for us. We should document this more properly eventually, but at least now we know how to respond when users ask for details regarding this.

I'm somewhat curious where the 16-4176-0 and 40 numbers come from?

/Simon


Top
 Profile  
Reply with quote  
PostPosted: Wed Jun 25, 2008 8:27 am 
Offline
Site Admin
Site Admin

Joined: Tue May 06, 2008 7:22 pm
Posts: 151
Btw, there is some Apple documentation on this as well:

http://docs.info.apple.com/article.html?artnum=302080

/Simon


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 10 posts ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 7 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group