News for hackers. Stuff that matters.

A comment on YubiKey 4C. Parent comment

Re:YubiKey 4C by cbhl on Monday February 13, 2017 @12:44PM (#13637164)
IIRC, the main reason that accessibility software doesn't have access to login screens is because malicious software has historically used accessibility APIs to steal passwords (e.g. by eavesdropping on a login screen, or by presenting a fake one and then using the accessibility APIs to pass through the password to the real one).
[ Parent | on HN ]
Re:YubiKey 4C by escapologybb on Monday February 13, 2017 @01:01PM (#13637313)
I think you are absolutely correct, and it's a really good reason not to switch the accessibility APIs on until the OS is fully decrypted and loaded.

Yep, right there with you and agree and everything. Still, sucks balls to be disabled in this situation and I'm also fairly sure that Apple has the engineering talent to make this possible. One would hope, anyway!

[ Parent | on HN ]
Re:YubiKey 4C by lstamour on Monday February 13, 2017 @02:54PM (#13638188)
Of course Apple can do it. IIRC, Microsoft has. And Apple does with their iPhones -- the keyboard is on screen! So of course it's possible. They're just ... busy? :)
[ Parent | on HN ]