Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

yubico.com

Post reply on HN
Print view View original

11–20 of 187 posts

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#11

Post by lambada »

arusahni wrote: post #8
lambada wrote: post #4

Flicking between the comparison tables at https://www.yubico.com/products/yubikey-hardware/compare-yub... and https://www.yubico.com/products/yubikey-hardware/compare-yub... it appears like the only differences between YubiKey 4 and Yubikey 5 NFC is i) the addition of NFC and ii) the addition of FIDO 2 support The differences between Yubikey NEO and YubiKey 5 NFC appear to be i) The addition of docker login support (…

IIRC the NEO only does TOTP over NFC. It sounds like the 5 does U2F over NFC, now?

Oh, interesting! That's not called out on their comparison chart for the NEO. That would certainly be a tempting upgrade for any NEO users then

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#12

Post by emlun »

arusahni wrote: post #8
lambada wrote: post #4

Flicking between the comparison tables at https://www.yubico.com/products/yubikey-hardware/compare-yub... and https://www.yubico.com/products/yubikey-hardware/compare-yub... it appears like the only differences between YubiKey 4 and Yubikey 5 NFC is i) the addition of NFC and ii) the addition of FIDO 2 support The differences between Yubikey NEO and YubiKey 5 NFC appear to be i) The addition of docker login support (…

IIRC the NEO only does TOTP over NFC. It sounds like the 5 does U2F over NFC, now?

NEO also does OpenPGP over NFC on Android. iOS only recently started opening up NFC to non-Apple developers.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#13

Post by theli0nheart »

This is fantastic! I'm super psyched about this.

> Works on Microsoft Windows, macOS, Linux and on major browsers such as Chrome, Firefox, Safari, Edge, and Opera [1]

I looked everywhere for documentation of Safari support but came up empty-handed. Does anyone know where this is documented? I've been waiting for this since forever.

[1]: https://www.yubico.com/product/yubikey-5-nfc/

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#14

Post by vader1 »

The difference between WebAuthn and U2F isn't really clear to me, but I hope the older generations will continue to work with common browser's FIDO2 implementations for a long time to come. YubiKeys are great, but too expensive to replace on a whim every year.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#15

Post by zhongfu »

arusahni wrote: post #8
lambada wrote: post #4

Flicking between the comparison tables at https://www.yubico.com/products/yubikey-hardware/compare-yub... and https://www.yubico.com/products/yubikey-hardware/compare-yub... it appears like the only differences between YubiKey 4 and Yubikey 5 NFC is i) the addition of NFC and ii) the addition of FIDO 2 support The differences between Yubikey NEO and YubiKey 5 NFC appear to be i) The addition of docker login support (…

IIRC the NEO only does TOTP over NFC. It sounds like the 5 does U2F over NFC, now?

U2F over NFC works on the NEO; I've been able to login to GitHub through Chrome with the Google Authenticator Android app. Same with Google account login on Android when adding an account to the device

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#16

Post by cflee »

Technical Manual at https://support.yubico.com/support/solutions/articles/150000...:

> Like FIDO U2F, the FIDO2 standard offers the same high level of security, as it is based on public key cryptography. In addition to providing unphishable two-factor authentication, the FIDO2 application on the YubiKey allows for the storage of resident credentials. As the resident credentials can store the username and other data, this allows for truly passwordless authentication. YubiKey 5 Series devices can hold up to 25 resident keys. If RSA keys are used, there is a maximum of three RSA with the rest being ECC.

I wonder what the user experience will be like at 25 resident keys, they mention that the YubiKey Manager (ykman) can set/change FIDO2 PIN and reset FIDO entirely, but nothing about managing individual resident keys/credentials.

It seems like it might be a bit challenging to manage this, especially if end-users accidentally register the authenticator multiple times or run out of the 25 slots for some other reason, and be told that they need to reset the whole authenticator and do recovery for all their sites...

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#17

Post by StavrosK »

vader1 wrote: post #14

The difference between WebAuthn and U2F isn't really clear to me, but I hope the older generations will continue to work with common browser's FIDO2 implementations for a long time to come. YubiKeys are great, but too expensive to replace on a whim every year.

U2F can only be used as a second factor. FIDO2 can be used as a replacement for a username/password, so you can go to a site, insert your FIDO2 key and log in without any other information.

Old Yubikeys only support U2F, and there's a Yubico FIDO2 key. Browser support isn't there yet, I've been trying to write a Django library for it but no browser will support the complete FIDO2 flow as far as I know.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#18

Post by cflee »

vader1 wrote: post #14

The difference between WebAuthn and U2F isn't really clear to me, but I hope the older generations will continue to work with common browser's FIDO2 implementations for a long time to come. YubiKeys are great, but too expensive to replace on a whim every year.

WebAuthn is backward compatible with U2F tokens, but naturally only for use as second factor. They defined CTAP1 as the U2F protocol for existing tokens, then defined the new CTAP2 for communication with the new tokens, and made both part of the spec.

From a Yubico blog post (https://www.yubico.com/2018/05/what-is-fido2/):

> WebAuthn and CTAP2 are both required to deliver the FIDO2 passwordless login experience, but WebAuthn still supports FIDO U2F authenticators, since CTAP1 is also part of the WebAuthn specification.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#19

Post by Leace »

lambada wrote: post #4

Flicking between the comparison tables at https://www.yubico.com/products/yubikey-hardware/compare-yub... and https://www.yubico.com/products/yubikey-hardware/compare-yub... it appears like the only differences between YubiKey 4 and Yubikey 5 NFC is i) the addition of NFC and ii) the addition of FIDO 2 support The differences between Yubikey NEO and YubiKey 5 NFC appear to be i) The addition of docker login support (…

5 is like a merger of NEO and 4, NEO has NFC and 4 has 4096 RSA keys. And then there is FIDO2 but until it's in widespread usage U2F works fine.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#20

Post by vader1 »

StavrosK wrote: post #17
vader1 wrote: post #14

The difference between WebAuthn and U2F isn't really clear to me, but I hope the older generations will continue to work with common browser's FIDO2 implementations for a long time to come. YubiKeys are great, but too expensive to replace on a whim every year.

U2F can only be used as a second factor. FIDO2 can be used as a replacement for a username/password, so you can go to a site, insert your FIDO2 key and log in without any other information. Old Yubikeys only support U2F, and there's a Yubico FIDO2 key. Browser support isn't there yet, I've been trying to write a Django library for it but no browser will support the complete FIDO2 flow as far as I know.

Ah, that's perfect. A hardware token as the /only/ factor sounds like a bridge too far anyhow.
Post reply on HN