7 ms·
It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager tha
by fluidcruft 7y ago
It would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password.
Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?
- peteretep 7y agoIt would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me
- trillic 7y agoThis is (sorta) how SQRL works. https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm
- fragmede 7y agoWhich, to be fair, is close to how it works inside Apple's walled garden. Logging into iCloud on a new computer will cause the iPhone attached to that account to pop-up a "confirm login" dialog, so the second factor for login is as unobtrusive as possible.
- tomp 7y agoNo you still need a password, which also makes it insecure on a public computer (where keyloggers might be installed). Instead, the better solution would be, you point your phone to a QR code on the computer screen, press “confirm”, the computer is magically logged in, until you then press “log out” on your phone and the computer is logged out.
- tatersolid 7y agoYou’ve just described SQRL
- iudqnolq 7y agoGoogle does that without needing a QR code if you have a recent Android and haven't enabled 2FA
- nicky0 7y agoHow does the communication from the computer to the phone work?
- iudqnolq 7y agoNo idea. Presumably a push notification. Within less than a second providing your email (on fast US data) you get a prompt on your phone that shows the browser model and approx location and asks you to approve or disapprove the login. They initially rolled it out as a 2FA option, then as an optional for 1FA.
- ec109685 7y agoIf an attacker has root on a public computer, a QR code is easily hackable as well: just man in the middle the scan process. So while you are logged in, the attacker can do anything they want.
- cm2187 7y agoThe signature of the QR code would need to be accepted by your mobile, not the public computer. I don’t think mitm the QR code process is possible if they sign it. But if the public computer is compromised, anything you log into from that computer is accessible by the attacker anyway, as long as the session is valid.
- tomp 7y agoThat’s true regardless of the login method. The benefit of the method I described is that you can 100% log out without any MITM, as you initiate the logout from a trusted device
- ec109685 7y agoYeah, agreed.
- wcip 7y agoWould you sue me if I tried to implement this? That is a amazing idea.
- dapperAF 7y agodo it. no one's going to sue for you implementing a random comment brainstorm.
- freehunter 7y agoThis has been done already, so no. There’s prior art. Look up Clef for one example. https://en.m.wikipedia.org/wiki/Clef_(app) https://en.m.wikipedia.org/wiki/Clef_(app)
- flurdy 7y agoI had high hopes for Clef, but unfortunately, it never got the traction it needed. That would require each site to implement server-side components to talk to Clef, and most sites have been ice age slow to implement basic TOTP never mind yet another method. Now, if the big existing OAuth sites, your Google, Facebook, Okta, etc implemented a QR code method like Clef then it might work.
- peteretep 7y agoI already need to do this to login to LINE on my computer, so no
- inetknght 7y agoOh hell that would be amazeballs if it's open source and worked on Windows, OSX, Linux, and could work with a 2FA device like Yubikey. I'd put $20 down for that in a heartbeat.
- asveikau 7y agoMake sure nobody takes a photo of you showing your qr code I guess.
- the8472 7y agoThe QR code would only contain a login challenge, the phone would complete the challenge. Of course that would mean the auth server must be publicly reachable or the phone must be in the same network.
- C14L 7y agoAs far as I understood, if somebody else scanned the same token, they would just login with their own account (if they have one). Whoever logged in first would invalidate the hexhexhex token and the second person would need to start another browser session.
- interactivecode 7y agoI know of a couple banking apps that use this. super handy!
- ben509 7y agoAll the QR code needs to encode is a URL pointing to their authentication endpoint. If it's reasonably standardized, any password manager could implement it. Login would be: * scan QR code, sees https:/ /megacorp.com/login?session=hexhexhex * Password manager asks that you want to log in with account X. * Negotiates with auth service * Website recieves your confirmed token via websocket * You're logged in. And, of course, if you don't have an account, the password manager can get you started creating one.
- notlukesky 7y agoSAASPASS does this as well. https://saaspass.com/ https://saaspass.com/
- osteele 7y agoThis seems to be the default for web apps here in China, such as Taobao or JD. Either the home page or the login page presents a QR code, and the mobile app has a scan icon.
- fluidcruft 7y agoYeah, I actually like the way Microsoft and Google do it when it just displays notification or number on my phone. Recently I logged in to a new Windows 10 computer and I didn't even have to type a password anywhere. Unfortunately I don't see the need to actually fill and type passwords going away any time soon. I'm mostly complaining about having to either: 1) Install the password manager on a computer to fill in passwords. You end up typing the password manager's password into the computer which could compromise the entire database as well as give the computer other information about your accounts and website usage. 2) Otherwise you have a password manager on your phone. You have to view the password and type it into a keyboard. Typing complex passwords is a pain in the butt. It would be nice if the password manager on my phone could just somehow type it for me. Then the only thing that goes into the computer is the exact password I'm trying to use.
- lawl 7y agoVery doable. I also want(ed) this. There are some old kernel patches on github that extend the android USB driver to also be able to register as an HID device. I also tried kicking the android driver and just using (iirc) usbfs or what is was called so you could implement HID in userspace and repurpose old phones while kicking android. But the vendor kernel stopped compiling :/ This woul imo be a really interesting application to repurpose old android phones.
- mongol 7y agoI also looked into this but was disappointed when I found that android support for USB HID only goes in one direction. You can attach a keyboard to your phone, but your phone cannot act like one. There are so many useful usecases for a phone like a keyboard it is too bad...
- lawl 7y agoYeah, this is why you either need to disable the android usb driver and use default linux ones (enabling which, broke the compile for the vendor kernel on my device) Or patch the android stuff to add HID support: https://github.com/pelya/android-keyboard-gadget https://github.com/pelya/android-keyboard-gadget
- mongol 7y agoYes but that rules out making a popular app out of it.
- denimnerd42 7y agoyou can use a teensy. i have a prototype that communicates to a teensy over serial connection and types in a pw from an app. could use wifi or bluetooth too.
- alain94040 7y agoThat's exactly what KeoPass[1] does: a biometric key (your fingerprint), that behaves like a no-driver-needed USB dongle/keyboard. Your grandpa could use it to secure his crypto wallet. [1] https://www.keopass.com/index_en.html https://www.keopass.com/index_en.html
- shakna 7y ago> Your grandpa could use it to secure his crypto wallet. For a certain sense of "secure". Because fingerprints aren't. Not just because you leave them everywhere, but because the way we examine fingerprints doesn't have a result that is particularly unique. Not even at the criminal case-law level [0][1]. That fingerprints are unique is an assumption, but it doesn't match our reality. They're useful for eliminating from a known small pool, not matching against a large group. Many of the elements we match against run in families. [0] https://mccoll-law.com/attorney-profile/37-general/38-fingerprints-are-not-unique https://mccoll-law.com/attorney-profile/37-general/38-finger... [1] https://www.telegraph.co.uk/science/2016/03/14/why-your-fingerprints-may-not-be-unique/ https://www.telegraph.co.uk/science/2016/03/14/why-your-fing...
- fluidcruft 7y agoI guess what I wonder about there is how do you deal with various password "rules" when generating the passwords? I really have no idea what that thing is doing. How does it know which password goes to which website? How do you create multiple passwords from your fingerprint?
- peterburkimsher 7y agoThe EspUSB Tiny can pretend to be a USB keyboard and mouse, and it fits inside a USB socket. I've built prototypes already, and I've found a manufacturer for scaling up, but it's stalled since August because of certification issues. It wouldn't be hard to add encrypted password storage to the EspUSB firmware. The difficulty is that you need to know the keyboard layout of the destination computer. Keyboards don't send a letter "A", they send "shift" + "a". If your computer's language setting is French, or German, or Chinese, etc - things get complicated fast. To make it worse, passwords need to use special characters (not just a-z). Sure, it's not unreasonable to ask you to change the keyboard layout, because you're on Hacker News and are therefore pretty good with computers. But this would limit an average user. The other problem is that it types the password as plain text, which is a bit insecure. If I have to carry a dongle and change settings on the client, why not make the dongle do some sophisticated key pair exchange with the client app? It's a good idea for another EspUSB demo app, but I worry that it couldn't find mass market adoption as a product. Without sales of over 10,000 devices, it's not possible to pay off the FCC certification lab, and I haven't got a solution for that.
- clarry 7y ago> The other problem is that it types the password as plain text, which is a bit insecure. If I have to carry a dongle and change settings on the client, why not make the dongle do some sophisticated key pair exchange with the client app? I kinda prefer simplicity. What if the dongle breaks, gets lost, or some change in the environment makes it impossible to run the client or perform this sophisticated key pair exchange? Locked out, fun. My keyboard can generate passwords, but I could generate the same passwords on paper (or, more likely, using a piece of software running on some other device) without ever connecting to the device where I'm going to enter that password.
- fluidcruft 7y agoThis is why I would prefer a dumb thing that's driven by my phone via a secure channel. I view the alternative as typing my password on the keyboard.