Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

yubico.com

Post reply on HN
Print view View original

121–130 of 187 posts

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#121

Post by helper »

mercutio2 wrote: post #117
tialaramex wrote: post #92

Earlier quoted context omitted.

You don't need $50 products. You especially don't need two of them. Yubico already make a Security Key that isn't also a PGP key store, a TOTP authenticator, bagel toaster and whatever else for about $20. And there are cheaper vendors if price is the main concern.

Why do you say you don’t need two? The argument seems pretty straightforward: if you don’t trust SMS, you need to disable all backup authentication. If you’ve disabled backup, you surely don’t your physical device to be a single point of failure?

You don't have to use sms as your backup authentication mechanism. TOTP and 1 time use codes are both better options.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#122

Post by mtgx »

georgyo wrote: post #5
Leace wrote: post #2

Wow, this looks really cool. Yubikey 4 lacked NFC support so with 5 it's easy to use the same key via USB-A (laptop) and NFC (via OpenKeychain on Android). It appears that RSA 4096 keys can be used via NFC, no other NFC-capable keys have this. One issue is that the algorithms did not change compared to 4. No ed25519, probably due to no tamper-resistant parts with this on the market.

Also the highest ECC is still p384 and does not support p521. However it is still really nice that it support rsa 4096 over NFC now.

I'd rather they support X25519 and X448 anyway.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#123

Post by mtgx »

georgyo wrote: post #7
pibefision wrote: post #3

I look forward for a more robust and durable hardware design. Maybe a ruggerized version?

I don't know how much more ruggerized you need it. It's already pretty dam strong. I've had a neo on my keys for years and it shows no sign of ware. They already are water proof and can be run over by a car. So unless you want to take a hammer to it, it should be rugged enough.

I'd be more concerned about general reliability. How long will these last? Because I think they should last at a minimum 10 years. If you only use one for an account, and it breaks on you, you're screwed.

So I would use at least 2, but hopefully websites will allow this, and that will probably be the largest bottleneck in the future. I couldn't care less about "SMS backups" or such nonsense, as that completely defeats the point of using a hardware token. Your account will only be as secure as your phone number is.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#124

Post by nikolay »

I just tried to order one. My credit card got charged twice as I attempted twice, got errors on their website, and the customer service rep Rachel in the online chat is behaving highly unprofessionally. My other attempts with another card were flagged as a possible fraud - obviously, their reputation among the credit card processors is not stellar. I think I'm done with Yubico and will be waiting for my Titan key from Google and consider the open-source SoloKeys as well. I think I've invested enough money in Yubico and what I'm getting back is not enough to justify the costs of this luxury. Their shortsightedness not to offer NFC on the USB-C version and to make the 4C/5C Nano so extremely hard to pull out is a clear sign they no longer are a good choice. And for quite some time, they haven't been the only choice either.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#125

Post by tomatocracy »

lvh wrote: post #57

I think the YK5's biggest problem is that the YK Neo and 4, which have been out for years, were already so good. Unless you really care about NFC at the same time as RSA-4096, I'm not sure I see a big impetus to upgrade. Hopefully the USB-C line won't be plagued with supply issues. WebAuthn is mostly boring and I think that's mostly a good thing. I'm glad that there's a way to evolve the spec. Some of the changes are…

The feature the 4 has which the Neo doesn't which matters most to me is 'touch to confirm key operation' when used via USB. I'm quite surprised how little this seems to be known - a hardware key which will sign anything a potential piece of malware or malicious actor asks for without question (assuming said malware is able to steal the PIN or get access to the appropriate agent socket which is not too much of a stretch) is a lesser improvement over pure software keys (sure, you can get the same effect by plugging and unplugging but thats a pain).

On the other hand, NFC is pretty much essential to me for use on an android phone. If this has both then I will look carefully at upgrading.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#126

Post by jiveturkey »

GoMonad wrote: post #50
cflee wrote: post #16

Technical Manual at https://support.yubico.com/support/solutions/articles/150000... : > Like FIDO U2F, the FIDO2 standard offers the same high level of security, as it is based on public key cryptography. In addition to providing unphishable two-factor authentication, the FIDO2 application on the YubiKey allows for the storage of resident credentials. As the resident credentials can store the username and other data,…

My understanding is that for udf / fido2 authentication, keys are not stored but rather regenerated with an HMAC https://developers.yubico.com/U2F/Protocol_details/Key_gener... I'm curious what these resident keys are for.

> keys are not stored but rather regenerated with an HMAC

That's an implementation detail to support an unlimited number of registrations. FIDO doesn't require derivation this way. Keys can be stored if desired. IMHO it would be superior, given that the device/protocol is designed as a first-class web-aware protocol, not a generic abstraction divorced from the reality of the primary use case. So, given that you are going to use the device with a web browser, the browser should assist you in storing the keys in the cloud. (NB: doesn't have to be and shouldn't be the raw key, it can be sealed by the device or even device/browser combination). This way you have a central location to find all of your registrations and can selectively revoke them easily.

Anyway ...

> I'm curious what these resident keys are for.

It was stated in the parent you are replying to:

>> As the resident credentials can store the username and other data

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#127

Post by kevin_b_er »

tialaramex wrote: post #92
kevin_b_er wrote: post #83

Earlier quoted context omitted.

The problem is that if poor solutions as far as usability are present, you'll have the telecos win. This is a race against Mobile Authentication Taskforce and their fundamentally insecure accounts. If the solution can't beat them, it'll get trampled. Those other "unsafe actors" are trying to completely take over authentication, meanwhile you need 2 $50 hardware security keys at a minimum to safely use this tech. This…

You don't need $50 products. You especially don't need two of them. Yubico already make a Security Key that isn't also a PGP key store, a TOTP authenticator, bagel toaster and whatever else for about $20. And there are cheaper vendors if price is the main concern.

The $20 one doesn't support a phone, regrettably. We need at least the $45 NFC edition, or it won't help people trying to log in with their phones. We continually talk on HN about how many are increasingly only using their phones and no longer use or posses general purpose computing devices. A USB-A only device only works for people still using computers. The Mobile Authentication Taskforce still wins and your only choice anywhere that isn't already highly technical will end up being Project Verify and the point of failure will still remain as socially engineering underpaid customer support staff.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#128

Post by jiveturkey »

dragonwriter wrote: post #82
bluGill wrote: post #46

Earlier quoted context omitted.

it is a different level of security. The comic is fully correct, but you should still use a secret. That is why there are 3 different types of authentication. The first is something you have - a card or key. The second is something you know - a password. The third is something you are - a fingerprint. Each provides protection against a different attack and is vulnerable to different attacks. The more important the se…

> The third is something you are - a fingerprint. A fingerprint isn't “something you are”, because it can be destroyed while you remain, and information about it can be captured and reproduced by attackers who are not you. It's just a particularly hard to lose (but easy to discover, and impractical to replace if compromised, at least more times than you have fingers) “something you have.” In security factor terms, I'…

"Something you are" is a term of art, not a very specific statement of fact to be legally overanalyzed. A fp is very much "something you are".

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#129

Post by saryant »

lallysingh wrote: post #41
fabian2k wrote: post #28

Earlier quoted context omitted.

You should have backup 2FA methods for that case, either more tokens at different locations or other 2FA methods like TOTP or printed one-time backup codes or all of these together.

I say take a morning and print out all your one-time recovery keys, put them in an envelope, and put that envelope next to your other important but rarely used documents.

Then buy a fireproof document safe and put all those documents in there.

Re: YubiKey 5 Series with New NFC and FIDO2 Passwordless Features

#130

Post by jiveturkey »

lvh wrote: post #59
village-idiot wrote: post #23

I’ve always been fascinated by these, but never had a justifiable reason to get one. The only use I could think of was protecting my LastPass account, but I figured my main risk there is their security getting breached, which Yubico wouldn’t help with.

U2F keys make you basically immune to phishing.

for the 10 or so websites that use them
Post reply on HN