search

maximbaz / yubikey-touch-detector

A tool to detect when your YubiKey is waiting for a touch (to send notification or display a visual indicator on the screen)
ISC License
415 stars 31 forks source link

Use gpgme for gpg detector, misc style fixes #51

Closed mochaaP closed 10 months ago

mochaaP commented 10 months ago

use gpgme for gpg detector move ssh socket to ~ suffix

mochaaP commented 10 months ago

the hmac watcher could be migrated to use ykpers, but i don't have a setup to test for that

maximbaz commented 10 months ago

the hmac watcher could be migrated to use ykpers, but i don't have a setup to test for that

Admittedly I don't use it myself either, but I believe it's as easy to set it up as to follow this:

$ ykman config usb -e OTP # enable OTP if you have it disabled
$ ykman otp chalresp --touch --generate 2 # generate a new random key in slot 2
$ ykman otp calculate 2 # when asked, give it any value (e.g. 00), then this will require touch

Interestingly, the current code does not detect the need to touch yubikey (for me). I don't know if it regressed (nobody opened an issue!), a quirk of my personal computer, or an issue in the setup above. But if you want to try it out, give it a go :grin:

mochaaP commented 10 months ago

revised with the suggestions.

mochaaP commented 10 months ago

ssh watcher could potentially use the sock_diag subsystem of netlink, but i couldn't find a good enough wrapper for that in golang. I guess the current method is the way forward, keep it as is

maximbaz commented 10 months ago

FYI I doubled the timings, because I experienced sporadic false positives when executing gpg sign operations, which do not require a touch, but just because they are slow, they triggered yubikey-touch-detector's notification.

We might have to increase them even more, if people report that on their computers they still get false positives...

I also cut 1.11.0 release, so you can just take the latest tag for packaging :wink: