Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

yubico.com

Post reply on HN
Print view View original

51–60 of 187 posts

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#51

Post by pps43 »

bluGill wrote: post #46
lugg wrote: post #39

Earlier quoted context omitted.

Because the something you know part isn't all that secure anyway? https://xkcd.com/538/

it is a different level of security. The comic is fully correct, but you should still use a secret. That is why there are 3 different types of authentication. The first is something you have - a card or key. The second is something you know - a password. The third is something you are - a fingerprint. Each provides protection against a different attack and is vulnerable to different attacks. The more important the se…

Calling a fingerprint "something you are" is a stretch. You are leaving fingerprints everywhere, they can be lifted from any smooth surface you touched (or even high-resolution photo) and then used to open biometric locks.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#52

Post by tP5n »

fabian2k wrote: post #32
village-idiot wrote: post #23

I’ve always been fascinated by these, but never had a justifiable reason to get one. The only use I could think of was protecting my LastPass account, but I figured my main risk there is their security getting breached, which Yubico wouldn’t help with.

I have one of the old blue U2F tokens (~20 EUR), and pretty much only used it for GMail so far. That alone is worth it to me because many other passwords can be reset by someone that gains control over my email account. I personally find the token much more convenient than a TOTP code via app on my smartphone. And the U2F/FIDO part is very interesting as it eliminates phishing as a risk. I ordered a Yubikey 5 NFC jus…

> I'm still looking for a password manager that could use an NFC Yubikey to unlock it on a smartphone.

AFAIK that's what lastpass+yubikeyneo (nfc) did, and what this should also be able to do.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#53

Post by Asturaz »

lambada wrote: post #4

Flicking between the comparison tables at https://www.yubico.com/products/yubikey-hardware/compare-yub... and https://www.yubico.com/products/yubikey-hardware/compare-yub... it appears like the only differences between YubiKey 4 and Yubikey 5 NFC is i) the addition of NFC and ii) the addition of FIDO 2 support The differences between Yubikey NEO and YubiKey 5 NFC appear to be i) The addition of docker login support (…

The only one with Fido2 at the moment I know is Microsoft Outlook/Office365.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#54

Post by tstevens »

theli0nheart wrote: post #48
tstevens wrote: post #47

Earlier quoted context omitted.

Looks like Webauthn support is being added to Safari. https://bugs.webkit.org/show_bug.cgi?id=181943

Great find, thank you! This is exactly what I was looking for. Weird that it's nowhere to be found in the Safari 12 release notes.

I don't believe support is in 12, I think it will be coming in a future release.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#55

Post by specialp »

_lbaq wrote: post #24

Honest question, what happens when you lose one of these ?

I actually have 2 Yubikeys, one with me, one in a safe place. But the price of these keeps rising. $50/$60 is starting to get a bit unreasonable for something that you were able to buy 2 or 3 of for the same price a few years back.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#56

Post by martinwww »

fabian2k wrote: post #32
village-idiot wrote: post #23

I’ve always been fascinated by these, but never had a justifiable reason to get one. The only use I could think of was protecting my LastPass account, but I figured my main risk there is their security getting breached, which Yubico wouldn’t help with.

I have one of the old blue U2F tokens (~20 EUR), and pretty much only used it for GMail so far. That alone is worth it to me because many other passwords can be reset by someone that gains control over my email account. I personally find the token much more convenient than a TOTP code via app on my smartphone. And the U2F/FIDO part is very interesting as it eliminates phishing as a risk. I ordered a Yubikey 5 NFC jus…

well code which U2f token generate with the help of Google authenticator has ONLY 6 digits. 6 digits that's not extremely hard to brute force is that right ?

If you are using additional backup u2f token (2 tokens in total) hacker has chance 1:500 000 to find out correct PIN is my assumption right ?

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#57

Post by lvh »

I think the YK5's biggest problem is that the YK Neo and 4, which have been out for years, were already so good. Unless you really care about NFC at the same time as RSA-4096, I'm not sure I see a big impetus to upgrade. Hopefully the USB-C line won't be plagued with supply issues.

WebAuthn is mostly boring and I think that's mostly a good thing. I'm glad that there's a way to evolve the spec. Some of the changes are arguably improvements; I could see how Direct Anonymous Attestation is better than the old certificate method. On the other hand, that's more exciting crypto than I want to see in W3C specs. But the vast majority of deployments don't care about attestation at all: they just care that you can register a specific U2F key once (say, during employee onboarding), and then you never have to care about attestation again. So other than crypto-nerdery, I'm going to choose not to care much about (EC)DAA.

U2F keys already do WebAuthn (individual sites doing bogus feature detection notwithstanding). Despite the name, at the end of the day U2F is just a way to sign some stuff so that it can't be replayed and you can't get phished. If you really wanted to use it as a single factor, you could.

I'm not sold that the integration of e.g. the browser's password manager into WebAuthn is super valuable, but I'm still happily monitoring what they come up with. That is not a criticism, and certainly not a deprecation. The bottom line is U2F was great, and WebAuthn not convincing me yet is not a good reason to shy away from WebAuthn. WebAuthn is still the best authentication mechanism we (realistically) have by far. Go use it.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#58

Post by lvh »

StavrosK wrote: post #17
vader1 wrote: post #14

The difference between WebAuthn and U2F isn't really clear to me, but I hope the older generations will continue to work with common browser's FIDO2 implementations for a long time to come. YubiKeys are great, but too expensive to replace on a whim every year.

U2F can only be used as a second factor. FIDO2 can be used as a replacement for a username/password, so you can go to a site, insert your FIDO2 key and log in without any other information. Old Yubikeys only support U2F, and there's a Yubico FIDO2 key. Browser support isn't there yet, I've been trying to write a Django library for it but no browser will support the complete FIDO2 flow as far as I know.

> U2F can only be used as a second factor.

I mean, certificationally, sure. But what prevents a website from trusting you to input your identifier (user name or e-mail address) and then accepting a U2F signed blob as your only credential?

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#59

Post by lvh »

village-idiot wrote: post #23

I’ve always been fascinated by these, but never had a justifiable reason to get one. The only use I could think of was protecting my LastPass account, but I figured my main risk there is their security getting breached, which Yubico wouldn’t help with.

U2F keys make you basically immune to phishing.
Post reply on HN