I have noticed that when auto-typing my passwords on my Linux computer (Fedora), the full password is not rendered. Not only that but the missing character seems to be shifting over most of the time in one place; sometimes 2 chars are missing instead. For example:
Saved Password: ILoveMyCats621!
with keymap set to QWERTY, I get these results:
#1: ILoveMyats621! #2: ILoveMyCts621! #3: ILoveMyCas621! #4: ILoveMyCat621! #5: ILovMyCats61! #6: ILoveyCats62! #7: ILoveMCats621 #8: ILoveMyats621! #9: ILoveMyCts621!
NOTE
The cable I'm using for these password outputs has been used to access accounts through the security token feature. Some devices don't acknowledge the badge, but if they do, the security token feature works well.
The outputs also seem to repeat the pattern. I tried the same cable into my Galaxy S22 and got the same exact results as the laptop. This time I requested more outputs and it does seem to repeat the cycle of missing chars
#1: ILoveMyats621! #2: ILoveMyCts621! #3: ILoveMyCas621! #4: ILoveMyCat621! #5: ILoveMyCats21! #6: ILovMyCats61! #7: ILoveyCats62! #8: ILoveMCats621 #9: ILoveMyats621! #10: ILoveMyCts621! #11: ILoveMyCas621! #12: ILoveMyCat621! #13: ILoveMyCats21! #14: ILovMyCats61! #15: ILoveyCats62! #16: ILoveMCats621 #17: ILoveMyats621!
This is making my ability to use the badge as a password manager a bit of a nuisance as I don't get consistent behavior device to device. I am not sure at all what can be causing this (I just started learning Rust), but I atleast don't seem to have this issue on my Windows computer.
Activity
2
gusir221d agoHey bunnie, thanks for the quick reply.
I'm currently still not in developer mode. Since you stated at 34 that this would wipe away secrets, I've kept mine as it came to me. I'm actually a web developer so this is still a different world to me. I'm using this badge as a motivation to learn Rust. My goal is to first be able to read your code and then see if I can find whatever secrets are there. I don't know how long it would take me but I really want to be able to do so. This was my first DEFCON and it really opened my eyes at a complete different angle of IT.
I actually brought up the missing QWERTY keymap to you through discord and waited patiently for your fix. I'm open to learning how to fix it and doesn't seem complicated; your explanation is pretty straight forward. I just don't have the hardware experience and trying so hard to not wipe the original data. I learn a lot from others and practice. For example, I learned a good amount of car mechanics and maintenance from a mechanic I befriended. He always forced me to do the work on my car but under his supervision. If you're able to coach me on any of this process like that, I'd love to give it a shot. If you're busy or rather build the patch yourself, I respect that too. I just want to keep my badge as an original.
Ah this is probably the device sending the characters too fast for the computer to keep up, and the computer is dropping characters as the device types it.
Try inserting this code:
self.usb_dev.set_autotype_delay_ms(100);At this line in this routine here:
https://github.com/betrusted-io/xous-core/blob/e8d989c754bcc3a9cd66f9e3e1c70cac580731eb/apps-baosec/vault2/src/ux.rs#L472
This will set the autotype delay to 100ms between keystrokes (it defaults to one every 30ms - most computers can keep up with this but some computers especially older ones can't keep up with that).
You'll need to build the firmware from source and upload it to the badge - which will put you into developer mode (this will cause all the original data on the device to be wiped). If you're not already in developer mode, I can try to put out a custom beta-signed firmware for you that has that patch in it and you can tell me if that fixes your problem. beta-signed firmware will not erase secrets like developer mode will.