Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

yubico.com

Post reply on HN
Print view View original

71–80 of 187 posts

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#71

Post by StavrosK »

lvh wrote: post #58
StavrosK wrote: post #17

Earlier quoted context omitted.

U2F can only be used as a second factor. FIDO2 can be used as a replacement for a username/password, so you can go to a site, insert your FIDO2 key and log in without any other information. Old Yubikeys only support U2F, and there's a Yubico FIDO2 key. Browser support isn't there yet, I've been trying to write a Django library for it but no browser will support the complete FIDO2 flow as far as I know.

> U2F can only be used as a second factor. I mean, certificationally, sure. But what prevents a website from trusting you to input your identifier (user name or e-mail address) and then accepting a U2F signed blob as your only credential?

The fact that if someone steaks the key they can impersonate you anywhere. U2F doesn't support pin authentication, as far as I know.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#72

Post by jfim »

jwr wrote: post #45
teagee wrote: post #38

Earlier quoted context omitted.

Do you have a link to the docs that shows this? From what I can find on their site [1] it only supports a few of the protocols: -Static Password -HMAC-SHA1 Challenge-Response -OATH-TOTP (Yubico Authenticator) [1] https://support.yubico.com/support/solutions/articles/150000...

IMHO the YubiKey is not useful for any of those. It's excellent for storing OpenPGP keys and U2F, reasonably good for X.509 (as much as expected for X.509 I guess), and not good for much else. Using it for TOTP IMHO makes no sense, it's better to use your phone.

Using it for TOTP makes sense if you have more than one phone or want to use TOTP on your desktop through Yubico authenticator.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#74

Post by xur17 »

specialp wrote: post #55
_lbaq wrote: post #24

Honest question, what happens when you lose one of these ?

I actually have 2 Yubikeys, one with me, one in a safe place. But the price of these keeps rising. $50/$60 is starting to get a bit unreasonable for something that you were able to buy 2 or 3 of for the same price a few years back.

I do the same thing, but my backup device is stored off-site, so it's pretty hard to make sure the backup device is connected to the same accounts as my primary ones. I currently keep a list of new accounts I've added and then periodically retrieve it and add the new accounts.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#76

Post by zyberzero »

methou wrote: post #75

Wonder what version openpgp their applet support, current app on Yubikey 4 and prior versions doesn't support ECC.

This doesn't do it either [0], unfortunately :(

[0] https://www.yubico.com/products/yubikey-hardware/compare-yub... - "ECC applies to the smart card applet only; does not apply to the OpenPGP applet. ECC P256 is the key type generated for the U2F keypair."

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#77

Post by NedIsakoff »

lugg wrote: post #39
kyrra wrote: post #33

Earlier quoted context omitted.

For 2FA, having multiple of these or some kind of recovery code tends to be the answer, as you can remove the keys from sites you use it on. I am less willing to use something like this for passwordless logins. These types of devices should be part of the "something you have" part of 2FA, which should always be paired with a "something you know". Maybe I'm missing a step here, but why would you ever use this for pass…

Because the something you know part isn't all that secure anyway? https://xkcd.com/538/

I honestly think the better one would be: "Hit his wife and kids until he tells us the password."

Much more effective.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#78

Post by Latty »

Alex3917 wrote: post #61
nikanj wrote: post #60

I have an iPhone and a Macbook. It's frustrating that I have to choose between USB-C support for the Macbook, and NFC support for the phone. It's odd that they don't make a USB-C version with NFC.

The 5C nano is designed to be plugged in the all the time though, so in that scenario what do you really gain from NFC?

There is the 5C (non-nano) where that argument doesn't apply anyway.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#79

Post by chimeracoder »

georgyo wrote: post #35
chimeracoder wrote: post #26

Earlier quoted context omitted.

> I don't know how much more ruggerized you need it. It's already pretty dam strong. I've had a neo on my keys for years and it shows no sign of ware. The first batch of the 4Cs were notoriously fragile. The plastic would break within a few months of normal use.

I was unaware, but I guess that sorta makes sense. I have only done with USB A style, which is an Epoxied PCB which makes it fairly hard to break. USB C has a connector that cannot just be the PCB, and so it needs a housing and such.

> I was unaware, but I guess that sorta makes sense. I have only done with USB A style, which is an Epoxied PCB which makes it fairly hard to break. USB C has a connector that cannot just be the PCB, and so it needs a housing and such.

The Yubikey 4C nano is hardier than the original Yubikey 4Cs were. I've had mine in for months, and it hasn't broken.

That said, I should note that my laptop (Macbook Pro) also decided to provide insane amounts of power to the USB-C ports on the left side, which fried the Yubikey - literally, there was smoke - and melted the plastic. (That's definitely Apple's fault, though, not Yubikey's fault).

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#80

Post by Latty »

village-idiot wrote: post #27
kasey_junk wrote: post #25

Earlier quoted context omitted.

Github and google support u2f. If you are a gmail user you should get a u2f device to protect your email. That said the cheaper yubi do this as well. I use my yubi 4 for securing my ssh key as well though this is a) a pain & b) likely theater.

I use an app based 2FA for that. Maybe I’ll look into a YubiKey though. My problem is that I’m halfway in my own personal transition from USB A to USB C

App based 2FA is still more vulnerable to phishing than a U2F key, because it relies on the user to check they are entering the code into the right website.

It's also faster and easier (no pulling out your phone, getting a code, typing it in, just touch the key).

Plus, the keys have other features (GPG keys, etc...) which can be useful.

Post reply on HN