8 Jul 2021 20:53 | apple | iOS
I love Yubikeys, they provide a very strong second factor for accounts and
services that you care a lot about. I use them for all kinds of things but one
thing I was quite excited to try was the Yubikey 5ci in static password mode.
Static password mode simply acts as a virtual keyboard, playing back a static
sequence of characters over the connected interface (usually USB). I wasn't
sure at first if this was supported over the lightning port but it turns out it
is which is very cool.
Using static password mode to supply the entire password for something is a bad
idea - if someone steals the key then they have the entire password and there's
no way to protect it on the key. Plug it in, press the sensor and voila you've
got the entire secret string. But using it in combination with a known
passphrase is very powerful. I was quite excited about the idea of using this on
iOS - a relatively simple password combined with a huge amount of extra entropy
from the Yubikey as a salt.
If you're going to attempt this, DON'T do what I did first and set the password
on the iPhone using the Yubikey. This is a really really bad idea - I did this
at first and although it appeared to work, the password set correctly, as soon
as I tried to unlock the phone by typing my passphrase and then activating the
Yubikey it didn't unlock. This was quite unnerving at the time but luckily I had
the secret string emitted by the key noted down and simply typing it in
carefully got me back into the phone. So learn from my mistake - type the
password into the iPhone very carefully rather than using the key to set it,
because if it just happens to fail in the same way twice in that moment you
might find yourself locked out of your device and facing the prospect of either
a lot of tedious guesswork (which and how many characters were dropped) or worse
- restoring from a backup.
At first I thought it was failing to unlock because it was sending the keys
too quickly. The Yubikey Personalisation Tool has an option to add up to 60ms
of delay between the keystrokes and this seemed to help, but it still wasn't
100% reliable. After further testing I eventually determined that the ! prefix
I was using was being converted into a 1 about 30% of the time. This did not
seem to happen on the mac so is likely something to do with iOS or the
lightning interface. I turned off the ! prefix and then found that the first
character that should be uppercase was occasionally being turned lowercase.
This glitch only seems to affect the first character of the password and it
seems to relate to the shift modifier. After disabling both the ! prefix and
uppercase characters it worked flawlessly every time without any input delay
necessary.
When it works it's really cool - FaceID most of the time and then when I need
to re-authenticate FaceID I have a much stronger password than before but also
don't need to actually type all of it.
There are a couple of downsides - you have to enable USB access on the lock
screen or else the key won't be able to talk to the phone in order to send the
keys. This seems like a reasonable trade-off for most people though - if you've
got someone plugging hardware into your phone to try to break into it you've
likely got much bigger things to worry about. To enable USB access go to
Settings -> FaceID & Passcode and make sure the "USB Accessories" checkbox is
enabled. The other downside is that the Apple leather case doesn't quite have a
big enough hole around the lightning socket for the key to insert, but that's
easily solved with a bit of sandpaper.
It's a very good idea to have more than one Yubikey. Also make sure you back up
the static secret somewhere, I recommend storing it in an encrypted file and
making several backups, including at least one offline.
