6 ms·
It's a USB keyboard that opens types some commands to open a hard-coded website. You can't really prevent that.
by makepanic 7y ago
It's a USB keyboard that opens types some commands to open a hard-coded website.
You can't really prevent that.
- AdmiralAsshat 7y agoThis is pretty much the way a Yubikey or other 2FA token works, no? The only difference being that it doesn't send the text until the sensor is covered.
- paxswill 7y agoIt's one way a Yubikey can work: Yubikey one time password (OTP). The more common (I think? Newer and standardized at least) way (U2F) accesses the key over some other method that doesn't have it act like a keyboard. There are other operation modes for Yubikeys, but personally I only use U2F and the CCID (aka act like a smartcard) modes.
- mikeash 7y agoYou could require confirmation before accepting a new input device. This could be done with out of band signaling (such as a button on the computer itself that you push to say “yes, I want to use this keyboard”) or you could do it by requiring the user to type in a secret (such as their login password, or even just a PIN displayed on the screen) to enable it for other uses. I don’t know that people would accept this inconvenience, though.
- deleted 7y ago[deleted]
- dijit 7y ago> or you could do it by requiring the user to type in a secret how would you accomplish this given that the normal situation is that you're plugging in a keyboard?
- codezero 7y agoI think the implication is you can type on the plugged in keyboard, but the OS won't pass the input through unless the first thing typed is a secret. This is somewhat similar to how bluetooth keyboards are enabled on macOS (or were the last time I connected one).
- mikeash 7y agoPrecisely. You get some authorization box and your input only goes to that box. If you authorize, it then acts like a normal keyboard.