Yubico Forum

I have recently received my Yubikey, and I think this is an innovative, easy to use two-factor authentication device. But I am a bit in because the modhex alphabet includes the English " i = I " character which corresponds to " i = İ ", or " ı = I " in Turkish. While Turkish Q keyboards are standard QWERTY keyboards which have some extra characters ĞÜŞİÖÇ placed on the right part of the keyboard. So I thought Yubikeys should work on these keyboards -that's why there's something called ModHex, but the " i " character is the problem here. So my Yubikey produces OTPs including " ı I " characters, because the I key on Turkish keyboards is used to print lower case ı and upper case I, which is the i letter in English. I think when you were evaluating different keyboard layouts which are used in many European countries and very similar to QWERTY, as the Turkish Q keyboards do, you shouldn't include the " I " key in ModHex. So I can't use my Yubikey with its plain state, but if I hold the Shift key in my keyboard and press my Yubikey, it generates upper case letters so the lower case ı's in the OTP became upper case I's which truly corresponds to English upper case " i = I " character. I hope systems and applications won't differentiate between upper case and lower case OTPs, or behave keyboard-layout-independent using some libraries some people have written. This problem is general within computer systems and applications as stated in http://www.codinghorror.com/blog/archives/001075.html by Jeff Atwood and in http://www.moserware.com/2008/02/does-your-code-pass-turkey-test.html by Jeff Moser. We suffer from this problem in many other situations.

I hope I will be able to continue to use my Yubikey on as many systems as if they support upper case OTPs. I think this situation should be stated on developer documents and there should be an option in the configuration tool, to make OTPs always in upper case. I hope this doesn't break some other things. (For example the option to make the first two letters upper case to conform with legacy systems can be changed to make the first two lower when used together with this option.)

Thanks for bringing this up. I must admit that Turkish was on the list of checked keyboards but I really did not notice the difference of the special Turkish lowercase i.

This needs to be taken care of in the backend, just like Cyrillic and other non-Latin alphabets. The Modhex coding is just used to avoid ambiguities, such as QWERTY and QWERTZ layouts that would cause problems otherwise.

We'll take a further look into this issue.

With the best regards,

JakobE
Hardware- and firmware guy @ Yubico

On the back end, all of our software supports US-Dvorak, which completely remaps QWERTY but is very easy to detect. I wish yubico would support dvorak mode for their online services so I wouldn't have to keep changing my keyboard language when I log in to the forums!