Show HN: yknotify – Notify when YubiKey needs touch on macOS (opens in new tab)

I've found that when I'm cloning submoduled private repos via YK-backed SSH key, I'll need to touch multiple times but there's not always text in the terminal notifying me to do so. Easy to miss the small flashing green light.

I have because I use it for a ton of stuff. Password manager, sudo locally, ssh logins, sudo remotely, openpgp decrypt etc.

It happens sometimes that I forget that's what it's waiting for. I'm no longer on Mac though. I have KDE. I don't always see the key flashing either because sometimes it's buried under the mess on my desk (I know...)

It's a bit annoying that yubikeys don't just trigger a hid event or something, as far as i understand the only way to tell is by looking for some obscure log entries.

Portability. I use YubiKeys with desktop Macs, MacBooks, iPads, and iPhones. The alternative would be to create (Secure Enclave) keys in each of those devices and register each of those keys with each thing requiring authentication... which could take a while.

I guess the alternative is something like Passkeys synchronized via iCloud Keychain. Hopefully Apple is encrypting the Passkey key material within the Secure Enclave using each other Secure Enclave's public key. Otherwise it kind of defeats the whole purpose of having a Secure Enclave. (If I remove a YubiKey from a computer, I have some assurance that computer can't authenticate with YK-controlled accounts.)

We support both at work (touchid and yubikey) and often I have my laptop in clamshell mode, so in that sense it’s easier to use the yubikey. Probably not the best reason, but works for me!

Must be a bass shell user

We can think about additionally having a key signature appear when the yubikey is being touched. The longer you hold it the more sharps. Or sometimes flats.

I hate that dialog, but I found out that you can just tap the yubikey anyway (before clicking) and it'll skip the step of "no, I don't want to scan a QR code with my iPhone"

The most common way I've seen this come up is for GPG signing of git commits. The flow is roughly: sign your first commit of the day -> you get a PIN popup, fill it in, and tap the Yubikey. Later in the day, you commit again -> your PIN is cached, so there's no reminder that you need to tap, other than the key LED blinking. If you don't clue in to what's going on, eventually it'll time out.

So this tool gives you the reminder to say "hey; you're doing a thing that's stalled waiting for your tap".

It reminds me of the way my car pops up on the display to say "hey, make sure to check the back seat" when I turn it off.