Why does the nitro key 2 app ask for admin rights on windows?

[xtc0r]

We want to use the nitrokey 3 in our corporate network and also use the nitrokey 2 app.
But when starting the app on Windows it asks for admin rights. That's a show stopper for a roll out.

Why does the app need admin rights? Is there a way to start it with a parameter to disable any needed admin functions?

Under linux the binary starts just fine without any priviliged rights.

[daringer]

yes, that's a massive drawback for the windows app2. The reason behind this is that the protocol used for communicating with the Nitrokey 3 (especially updates and secrets so far I remember), which is forbidden for non-privileged users - therefore we currently enforce Administrator permissions through UAS.

The last time I checked I didn't find a proper way to get around this. But my Windows know-how is limited, and we haven't had the chance to look deeper into it recently.

Can you tell what functionality you want to use from the NitrokeyApp2 within Windows ?

[xtc0r]

Thanks for the reply. I order the functions based on priority:

1. TOTP -> Must have
2. FIDO -> Must have but we could do a first roll out with only TOTP
3. Password store -> Nice to have
4. Firmware Update -> Nice to have, but we can do it on linux

[xtc0r]

The last time I checked I didn't find a proper way to get around this. But my Windows know-how is limited, and we haven't had the chance to look deeper into it recently.

Is there a chance to fix this? Otherwise I have to put them all in the trash.
We wanted tu support a German Company but it was nowhere stated that the app needs admin rights for windows. How would any bigger company use this?

[daringer]

understood - let me check for some solution, one might be to pipe all communication through another protocol (ccid?) ... Concerning you list:

• fido2 does not need the app2 - any browser will do and windows-settings for pin handling
• totp and password store are essentially the same - this will be tricky, will come back to you
• firmware update will be to most complicated, if not impossible within windows

[xtc0r]

thanks for looking into it! We are fine, when the firmware update does not work on windows.