Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 7:32 pm

All times are UTC + 1 hour




Post new topic Reply to topic  [ 15 posts ]  Go to page Previous  1, 2
Author Message
PostPosted: Tue Jan 13, 2009 1:04 pm 
Offline
Site Admin
Site Admin

Joined: Wed May 28, 2008 7:04 pm
Posts: 263
Location: Yubico base camp in Sweden - Now in Palo Alto
You're right - it does not work by the means of the autorun feature but rather that a WIN+R + string is sent.

It is a different configuration item so yes - it can be wiped without affecting the OTP generation settings.

But as this is an unofficial feature of the Yubikey (there are quite a few issues with it), we don't have a tool for it. You need to use the configuration API and write a blank string to SLOT_NAV (2).

Regards,

JakobE
Hardware- and firmware guy @ Yubico


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

PostPosted: Tue Jan 13, 2009 4:43 pm 
Offline
User avatar

Joined: Tue Jan 13, 2009 6:33 am
Posts: 20
Oops my bad, you are correct. :oops:
It does 100% work without the U3 autorun.

Hmm, looks like there's a similar command for KDE & GNOME = Alt+F2
Perhaps it'll work with "Go to Browser" Cmd+L for Mac OS, if Safari/FF3 is already running?
http://en.wikipedia.org/wiki/Table_of_k ... _shortcuts


Here's three ways to Disable or control Winkey on keyboard (plus there's TweakUI) :arrow:

How to Disable Winkey on keyboard:
(Formerly Q216893, Now uses Keywords: kbenv kbinfo KB216893)
http://support.microsoft.com/kb/216893

Fully control the keyboard with "I Hate This Key Deluxe Edition":
http://www.bytegems.com/ihatethiskeydeluxe.shtml

Another how to Disable Winkey on keyboard pre-Vista solution:
http://www.windowsnetworking.com/kbase/ ... board.html

More info about the Win Key:
http://en.wikipedia.org/wiki/Windows_key


Top
 Profile  
Reply with quote  
PostPosted: Tue Jan 13, 2009 8:15 pm 
Offline

Joined: Sun Jan 11, 2009 4:40 am
Posts: 41
Thanks, JakobE.

That's exactly what I would like to do. I agree that there are some potential problems with this feature. Perhaps I'm paranoid, but I find that feature a bit of a concern from a security point of view since it could be used for something other than directing a browser to a web page. I realize that someone would have to program the Yubikey to do that, but envision at least the theoretical possibility that a malware script could reprogram the Yubikey to do something undesirable which could then occur on each machine on which I used the Yubikey.

I understand from another thread that there's a more user friendly configuration utility in the works and will probably await its release before messing with this.

DH2007,

I appreciate the info, but don't really want to completely disable the Win key, merely the Win+R combination. Looks like I'd have to use something like a simple AutoHotkey script to do that. Now that I know that I can reprogram the Yubikey to remove the auto-navigation without interfering with the OTP function, I can do it that way and not have to fiddle with the key mapping.

Dick


Top
 Profile  
Reply with quote  
PostPosted: Wed Jan 14, 2009 3:55 am 
Offline
User avatar

Joined: Tue Jan 13, 2009 6:33 am
Posts: 20
I must admit I used the U3 Uninstall and never considered the Win key a threat.
Simply because the Win key seemed to be a physical access security issue.
(Versus a software (worm/virus/trojan) type threat.)

Seeing the point you made Dick.
It's time to rethink the security layers & computer hardware again.


Hmmm, I've heard good things about a program called Sandboxie but I haven't tried it yet.


Top
 Profile  
Reply with quote  
PostPosted: Fri Oct 16, 2009 9:47 pm 
Offline

Joined: Fri Oct 16, 2009 9:40 pm
Posts: 2
pilot wrote:
Yes. I believe you are right. I programmed my key to achieve plug in to log in to MashedLife.com to make using Mashed Life even easier.

But I can't do plug in to log in to Yubico forum at:

ucp.php?mode=login?otp=......

Any tips? Is it the problem of the forum or the key???

If plug in to login to blog in one shot, that will be REALLY COOL.

:lol:


Hi, pilot, what do you really mean? I thought the question is that can you program the auto-navigation URL to a different URL other than Mashed Life ???

Is there any protection about who can re-program the URL? If there is no password protection of the authority, that is risky business.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 15 posts ]  Go to page Previous  1, 2

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group