Yubico Forum

Hi,

Just got my Yubikeys and playing around at the moment. First thing I notice is that inserting the Yubikey in a Mac Mini (OSX 10.5.3) causes the keyboard setup assistant to appear. This attempts to identify the new 'keyboard' and asks me to press a key. I can just click 'continue' and ignore the assistant but this will soon become a drag. Anyone else had this and managed to stop it appearing?

Thanks.

--
Patrick

We've spent some time drilling into this issue and the following findings have been noticed:

1. Attaching an original Apple USB keyboard works straight away without any identification dialog.

2. A "Microsoft Comfort Keyboard", which claims to be "MacOS X compatible" brings up the identification dialog, just like with the Yubikey

3. A noname $10 "China" USB keyboard without any claims whatsoever causes exactly the same to happen

4. Spoofing the Yubikey's USB Vendor ID (VID) to 0x5ac (Apple Computer, Inc) and the USB Product ID (PID) to 0x221 (Apple USB MB110S/A keyboard) takes the question away. Most likely, Apple won't like if we spoof their IDs, but we just did it for the sake of testing

5. A non-Apple keyboard make the key "Change Keyboard Type..." button to appear under the System Profiler.

6. Spoofing the VID to be 0x5ac (Apple inc) of the device makes the button to disappear.

7. Analyzing the USB traffic from enummeration and onwards does not reveal anything specific for Apple keyboard vs. the non-Apple one.


These findings leads into the conclusion that the Mac seems to accept Apple keyboards based on the Apple VID only. All other VIDs requires you to identify your keyboard by pressing the key right to the left shift. Spoofing with Apple's VID and different random PIDs seems to be accepted as well.


This distills into our recommendation:

- When the Yubikey is inserted for the first time, the OS will ask you to identify your USB keyboard. This occurs for non-Apple proprietary USB keyboards.

- The dialog says "Your keyboard cannot be identified and will not be usable until it is identified. To identify this keyboard click Continue"

- Just kill the dialog and the Yubikey works straight away.

- Alternatively, press Continue and when the "Identifying your keyboard" dialog appears, press the Yubikey key. A message says that the keyboard cannot be identified. Ignore this and just fill in the keyboard type. Select ANSI and it all works fine.

- This question just appears once. The OS seems to remember your settings even if the dialog is clicked away.


A slight annoyance, I agreee. But hopefully something we can live with.


Any input in this issue is of course accepted

Regards,

JakobE
Hardware- and firmware guy @ Yubico

Hey, thanks for the quick and detailed response. Its not really a problem, but you do have to be logged in as an admin user for the settings to stick. I wasn't doing this initially, and kept getting the dialog every time I inserted my key.


--
Patrick

This guide is very helpful!

mac_kb/

Cheers

Does anyone know where Mac OS X stores the information about the inserted keyboard? It must have a registry or similar where it remembers that it has asked the "identify keyboard" question for the yubikey. Possibly we could ask Apple to add the Yubikey to an automatic white-list. Alternatively, we can write a small Mac OS X application that sets the registry the right way directly.

Other ideas are welcome.

/Simon

I don't really know what sort of things can be stored in there, but there is a keyboard "plist" file in a directory (sorry... the word is "folder" for you Mac users ) somewhere. I think the folder name is "Preferences", but I'm not quite sure where it lives.

I'll try to dig into a co-workers Mac tomorrow and get back with the specifics.

_________________
--
Greg Estep

The file is /Library/Preferences/com.apple.keyboardtype.plist

When I started the file didn't exist. I then inserted a YubiKey, and went through the keyboard assistant (see mac_kb/). The file was created with the following contents.

_________________
--
Greg Estep

This command will add the Yubikey keyboard entry to that plist file. If the plist file does not already exist, the command will create it:

If you manage a lot of Macs then you can just push that command out to them with Apple Remote Desktop and then your users won't be prompted when they insert their Yubikey.

I have only tested this command out on MacOS X 10.5.3. It may or may not work on 10.4 Tiger installs.

Greg, James, thank you very much for finding this out for us. We should document this more properly eventually, but at least now we know how to respond when users ask for details regarding this.

I'm somewhat curious where the 16-4176-0 and 40 numbers come from?

/Simon

Btw, there is some Apple documentation on this as well:

http://docs.info.apple.com/article.html?artnum=302080

/Simon