Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 4C

yubico.com

Post reply on HN
Print view View original

31–40 of 266 posts

Re: YubiKey 4C

#31

Post by jordskott »

simias wrote: post #27
serg_chernata wrote: post #7

It looks neat, can someone share personal experience or recommendations? Is this worth it? Is there a better alternative?

I use a Yubikey 4 with the GnuPG smartcard applet to secure all my password, sign my emails and connect to remote computers with SSH. It's super convenient and I'd never go back. That being said I got a bit concerned about the use of closed source components in newer yubikeys (I believe that the yubikey 4 is open source and the later ones aren't, but don't trust me on that). For this reason I also bought a nitrokey a…

To be honest, Yubikey was never really open source. Sure, they open sourced _some_ compomnents before but you coulnd't do anything with the source.

Re: YubiKey 4C

#32

Post by NikolaNovak »

Freak_NL wrote: post #20
NikolaNovak wrote: post #14

Do they work any better on iPhones? ----- I decided couple of months ago to secure entire family. Bought half dozen Neos, worked out all the kinks on my computer + Android phone first, put everything in LastPass (I know, I know, I know... but you have to consider the target audience ;).... only to discover on "go-live" that my wife's iPhone 6s is bloody useless with the thing. Apparently iPhone doesn't fully grok NFC…

Apple decided that users cannot use the NFC chip in it except for Apple Pay (for the foreseeable future). You don't really 'own' an Iphone in that sense.

  users cannot use the NFC chip in it except for Apple Pay
That... boggles my mind :-O

Thanks for the info. My wife is unfortunately locked into iPhone due to work standard, but something to keep in mind long-term.

Re: YubiKey 4C

#33

Post by adrianN »

Freak_NL wrote: post #24
abhv wrote: post #19

alternative is u2fzero, available on amazon for 8$, and totally open source. the difference is that yubi uses an nxp secure coprocessor, whereas the u2fzero uses atmel. there is the possibility of side-channel attacks on the u2fzero. but for your family, it is better than nothing and much more cost effective.

> […] there is the possibility of side-channel attacks on the u2fzero. Interesting. How does that work? Have you any references to that?

https://github.com/conorpp/u2f-zero/wiki/Security-Overview

Re: YubiKey 4C

#34

Post by LeifCarrotson »

jupp0r wrote: post #22

Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.

> Not having it inserted defeats the whole point

How so? I would keep this on a keychain or lanyard (it looks rugged enough to handle that sort of environment). When I need to authenticate, I plug it in, when I'm done, I unplug it. That seems a lot more secure than leaving it in the computer all the time. If someone gets my computer and the YubiKey is always installed, that sort of defeats the purpose of having a separate hardware security device. In that case, why not just use Keypass?

Re: YubiKey 4C

#35

Post by akulbe »

jupp0r wrote: post #22

Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.

Do you have to leave it plugged in to your computer the entire time? or just times you need 2FA?

Re: YubiKey 4C

#36

Post by danjoc »

jupp0r wrote: post #22

Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.

If that's what you do, why wouldn't you prefer something built in? Like TPM?

Re: YubiKey 4C

#37

Post by baq »

cafebabbe wrote: post #12
serg_chernata wrote: post #7

It looks neat, can someone share personal experience or recommendations? Is this worth it? Is there a better alternative?

Had one, loved it, then lost it, then hated it.

that's why you always have to have two, preferably 3 - one stored off site somewhere. physical locks also come with at least 3 keys.

Re: YubiKey 4C

#38

Post by ckok »

abhv wrote: post #19

alternative is u2fzero, available on amazon for 8$, and totally open source. the difference is that yubi uses an nxp secure coprocessor, whereas the u2fzero uses atmel. there is the possibility of side-channel attacks on the u2fzero. but for your family, it is better than nothing and much more cost effective.

You have a link? The only thing I get for u2fzero is their site with instructions on how to build one.

Re: YubiKey 4C

#39

Post by danjoc »

tckr wrote: post #16

Make the price $5 and these will sell.

Sometimes they do. They did when they launched yubikeys on github. You could get a yubikey with github logo on it for $5, limit 2. They were U2F only, but I still purchased two for the novelty.

Re: YubiKey 4C

#40

Post by treve »

jupp0r wrote: post #22

Until there's a YubiKey 4C nano, I'll wait. Having something of that size sticking out of my computer is not really practical. Not having it inserted defeats the whole point.

I'm kind of wondering what the benefit is over having something like Yubikey at all instead of something that's just software when you just leave it in all the time.
Post reply on HN