Strive Automating a YubiKey Button Press

Just a few weeks in the past, my daughter (Noa, 9) and son (Ethan, 7) sat in my house workplace minding their very own enterprise (iPads).

Then my son requested me:

• Son: “Dad, why do it’s essential contact that “factor” over there?”
• Me: “Oh, that’s an incredible query! That “factor” is named “YubiKey”. It’s a simple and quick solution to safe and entry my accounts. For instance, to entry my Gmail account, I have to enter a password AND bodily press the important thing“
• Son: “Bodily press the important thing? mmm… can’t you ask Alexa or Siri?” (He’s a HUGE fan of Alexa)
• Me: “hehe, no no no, the YubiKey was really designed for a human contact. The gold component you see there’s meant to answer a full finger contact“
• Daughter: “Dad, why didn’t you automate that??” (She is aware of me properly 😉)
• Me: “First, I don’t assume that it may be automated… Second, why ought to I automate a YubiKey press??“
• Daughter: “Why not? It feels like a enjoyable problem. No??“

How does the YubiKey work? 🤔

YubiKey is a tool that makes two-factor authentication utilizing a single button. Every YubiKey machine has a singular configuration to generate distinctive codes that affirm your id.

On a really excessive stage, the YubiKey has a capacitive contact sensor that measures your physique’s capacitance to the bottom (i.e., if you contact the plate, you’re growing capacitance).

Every capacitive sensor has a particular configuration/algorithm to recalibrate. Normally, when you un-touch the plate (i.e., take away the extra capacitance), it can reset the recalibration timer.

Along with the recalibration algorithm, the capacitive contact space and capacitive contact sensitivity are pre-configured and can’t be modified.

So… Can we automate a YubiKey button press? 🙄 

I suppose that the reply is No & Sure. Let’s reply the next questions:

• Can we script the YubiKey button press – No
• Can we leverage a “Sensible Swap Button Pusher“ to push a button – Sure
• Can we leverage API calls to manage the “Sensible Swap Button Pusher” – Sure
• Can we script the API calls – Sure
• And the most important query of all…  Can we “trick” the YubiKey capacitive contact sensor to work with OTHER objects than a human determine? – Sure (There are a number of methods to try this. The frequent floor to all is the necessity to hook the capacitive sensor in direction of the bottom, so it can “assume” it’s conductive as a human determine/sufficient).

Automation “Substances” 🗒

1. YubiKey 5 or 5C (I used the 5C NFC)
2. Electrical energy conductor (I used a normal “emergency door pin key”)
3. Capacitive sensor set off – I used a headphone cable (Headphone wires are negatively charged and often coated with rubber. The friction of the wires is answerable for the induction of cost. When the Headphone jack touches the capacitive contact, it’s thought-about as a contact)
4. Sensible Swap Button Pusher (I used a SwitchBot, however others will work as properly)
5. Lego bricks 🙂
6. curl/AppleScript/Python/PowerShell (What works greatest for you?)

⭐️ And the end result is… YubiKey Auto-Button Presser! ⭐️

The Setup:

The Code:

curl:

curl --location --request POST 'https://api.switch-bot.com/v1.0/gadgets/E3233xxxx/instructions' 
--header 'Authorization: Bearer xxxx' 
--header 'Content material-Kind: utility/json' 
--data-raw '{
"command": "turnOn",
"parameter": "default",
"commandType": "press"
}'

AppleScript & curl:

do shell script "curl -X POST https://api.switch-bot.com/v1.0/gadgets/E3233xxxx/instructions --header 'Authorization: Bearer xxxx' --header 'Content material-Kind: utility/json' --data-raw '{"command": "turnOn", "parameter": "default", "commandType": "press"}'"

Python:

import requests
import json
​
url = "https://api.switch-bot.com/v1.0/gadgets/E3233xxxx/instructions"
​
payload = json.dumps({
"command": "turnOn",
"parameter": "default",
"commandType": "press"
})
headers = {
'Authorization': 'Bearer xxx',
'Content material-Kind': 'utility/json'
}
​
response = requests.request("POST", url, headers=headers, information=payload)

PowerShell:

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Authorization", "Bearer xxx")
$headers.Add("Content material-Kind", "utility/json")
​
$physique = "{`n `"command`": `"turnOn`",`n `"parameter`": `"default`",`n `"commandType`": `"press`"`n}"
​
$response = Invoke-RestMethod 'https://api.switch-bot.com/v1.0/gadgets/E3233xxxx/instructions' -Methodology 'POST' -Headers $headers -Physique $physique
$response | ConvertTo-Json

The movies:

Triggering a YubiKey button press utilizing curl command

Triggering a YubiKey button press utilizing AppleScript

Triggering a YubiKey button press utilizing voice command

Closing Ideas 💡

Sure, it was a enjoyable problem, and I might automate the YubiKey button press. However does it actually should be automated? Nicely, my automation viewpoint is:

• Not EVERYTHING must be automated
• There is no such thing as a single excellent automation instrument. Choose a instrument that greatest serves you and the customers
• Don’t reinvent the wheel, leverage present instruments, options, and assets

What must be automated? For instance (making an attempt to maintain it easy 🙂):

• Time-consuming and repetitive duties
• Duties inclined for human-errors
• Duties that should be monitored/alerted

Humorous Anecdote 
I’m sitting for too many hours… Sure, I’ve a standing desk, however I’m “forgetting” to make use of it. Sure, I even scheduled reminders to face and stretch, however I maintain clicking on “dismiss.” So, my newest “innovation” is to attach the YubiKey utilizing a protracted USB-C cable. Each time I have to press the YoubiKey button, I MUST rise up and stroll (a number of steps) to the YubiKey.

Let’s see how properly that works… 😉

Associated assets:

• I’m utilizing Cisco Duo multi-factor authentication (MFA) for all my delicate apps and information, which is the only and only solution to be sure you are who you say you’re.
•  Need to discover extra about safety, YubiKey, and MFA?
  Take a look at the DevNet Safety Dev Heart.
• Need to study extra about how YubiKey can be utilized with IoT-related tasks and APIs?
  Take a look at the DevNet IoT Dev Heart.

We’d love to listen to what you assume. Ask a query or go away a remark beneath.
And keep linked with Cisco DevNet on social!

LinkedIn | Twitter @CiscoDevNet | Fb |  Developer Video Channel

Share: