61–70 of 187 posts
I have an iPhone and a Macbook. It's frustrating that I have to choose between USB-C support for the Macbook, and NFC support for the phone. It's odd that they don't make a USB-C version with NFC.
I have a 4C and think it is great - the only downside is the lack of NFC and that only a subset of sites support it, but more are implementing it as time goes on.
I'll probably pick up a 5 as one to store on a keyring for mostly NFC use.
Earlier quoted context omitted.
Github and google support u2f. If you are a gmail user you should get a u2f device to protect your email. That said the cheaper yubi do this as well. I use my yubi 4 for securing my ssh key as well though this is a) a pain & b) likely theater.
I use an app based 2FA for that. Maybe I’ll look into a YubiKey though. My problem is that I’m halfway in my own personal transition from USB A to USB C
I’ve always been fascinated by these, but never had a justifiable reason to get one. The only use I could think of was protecting my LastPass account, but I figured my main risk there is their security getting breached, which Yubico wouldn’t help with.
I have one of the old blue U2F tokens (~20 EUR), and pretty much only used it for GMail so far. That alone is worth it to me because many other passwords can be reset by someone that gains control over my email account. I personally find the token much more convenient than a TOTP code via app on my smartphone. And the U2F/FIDO part is very interesting as it eliminates phishing as a risk. I ordered a Yubikey 5 NFC jus…
How does that work? Can't the challenge response be MITM?
Earlier quoted context omitted.
Great find, thank you! This is exactly what I was looking for. Weird that it's nowhere to be found in the Safari 12 release notes.
I don't believe support is in 12, I think it will be coming in a future release.
Meanwhile telcos are working hard to convince the public they should all throw in with their insecure telecos accounts as a chain of trust after time and time again showing that your telco account is trivial to steal.
Not convinced on FIDO2, either. It means you need TWO of these devices. One as a backup and another as the common case. Why? Because if you lose a single physical key, you'd have to recover your account. Recovering your account will probably end up being insecure SMS auth or easily socially engineered below-US-min-wage outsourced phone support.
I have an iPhone and a Macbook. It's frustrating that I have to choose between USB-C support for the Macbook, and NFC support for the phone. It's odd that they don't make a USB-C version with NFC.
The 5C nano is designed to be plugged in the all the time though, so in that scenario what do you really gain from NFC?
Technical Manual at https://support.yubico.com/support/solutions/articles/150000... : > Like FIDO U2F, the FIDO2 standard offers the same high level of security, as it is based on public key cryptography. In addition to providing unphishable two-factor authentication, the FIDO2 application on the YubiKey allows for the storage of resident credentials. As the resident credentials can store the username and other data,…
My understanding is that for udf / fido2 authentication, keys are not stored but rather regenerated with an HMAC https://developers.yubico.com/U2F/Protocol_details/Key_gener... I'm curious what these resident keys are for.
We'll see. There was barely any uptake of FIDO U2F on the web. Sure there were a few major players, like google, but pretty much nothing financial for the public have taken up anything but insecure SMS/call authentication. Meanwhile telcos are working hard to convince the public they should all throw in with their insecure telecos accounts as a chain of trust after time and time again showing that your telco account…
I have an iPhone and a Macbook. It's frustrating that I have to choose between USB-C support for the Macbook, and NFC support for the phone. It's odd that they don't make a USB-C version with NFC.
The 5C nano is designed to be plugged in the all the time though, so in that scenario what do you really gain from NFC?