11–20 of 178 posts
Does it do U2F on an iOS device?
> At launch, it’ll support these well-known password managers and single sign-on tools: 1Password, Bitwarden, Dashlane, Idaptive, LastPass, and Okta. And when using the Brave browser for iOS, the YubiKey 5Ci can be used as an easier way to log into Twitter, GitHub, 1Password’s web app, and a couple other services.
> Security keys offer almost unbeatable security and can protect against a variety of threats, including nation-state attackers. Alright, I'm not a security expert, but I'm not completely illiterate to basic computer security. Anyone care to chime in how this is much more secure than a two-factor app? Sure there's the obvious, nobody can just copy the two-factor app off my phone with all the codes and have the same c…
That is precisely what these devices are designed to stop. The device has a private key stored in hardware in a way that it cannot be retrieved by software. When you use one of these devices you dramatically decrease your number of attack vectors because now the attack has to happen physically. Someone has to actually steal your physical key. And because this is your "second factor", if that happens they still also have to have your password.
Two-factor apps get closer to this, but they usually can be copied. For instance, 1Password can be set up to mimic Google Authenticator.
> I do want to know if this is purely marketing hype
This is most definitely NOT marketing hype. It is the current security best practice.
> Security keys offer almost unbeatable security and can protect against a variety of threats, including nation-state attackers. Alright, I'm not a security expert, but I'm not completely illiterate to basic computer security. Anyone care to chime in how this is much more secure than a two-factor app? Sure there's the obvious, nobody can just copy the two-factor app off my phone with all the codes and have the same c…
If I knew I could use my keys at more services, I would already have upgrade the daily driver to a NFC variant (so I could use it with my phone).
So, to any webdevs on HN reading this: Take that shit serious and implement 2FA ;-)
//edit: GitHub is just a single example; and it's possible to opt-out of SMS, if a authenticator app is used instead. That's what I mean by second class citizen: Security Key(s) + X is possible, but while X alone can be configured, Security Key(s) alone is(/are) not allowed.
> Security keys offer almost unbeatable security and can protect against a variety of threats, including nation-state attackers. Alright, I'm not a security expert, but I'm not completely illiterate to basic computer security. Anyone care to chime in how this is much more secure than a two-factor app? Sure there's the obvious, nobody can just copy the two-factor app off my phone with all the codes and have the same c…
> whose to stop someone from cloning a Yubico key? That is precisely what these devices are designed to stop. The device has a private key stored in hardware in a way that it cannot be retrieved by software. When you use one of these devices you dramatically decrease your number of attack vectors because now the attack has to happen physically. Someone has to actually steal your physical key. And because this is your…
Just out of curiosity, is Apple migrating away from Lightning toward USB-C? $70 for one key is a bit steep especially if Apple eventually shelves Lightning on iPhones.
If you're already planning to buy a new iPhone in September, you should probably wait to buy any accessories. (And in truth, my gut is that Apple will stick with lightning on iPhones for some time.)
Just out of curiosity, is Apple migrating away from Lightning toward USB-C? $70 for one key is a bit steep especially if Apple eventually shelves Lightning on iPhones.
> Security keys offer almost unbeatable security and can protect against a variety of threats, including nation-state attackers. Alright, I'm not a security expert, but I'm not completely illiterate to basic computer security. Anyone care to chime in how this is much more secure than a two-factor app? Sure there's the obvious, nobody can just copy the two-factor app off my phone with all the codes and have the same c…
> cloning a Yubico key This should be impossible.