151–160 of 187 posts
How many usernames can a Yubikey 5 remember in the FIDO2 mode? CTAP1 requires no storage beyond a token-wide counter.
I have an iPhone and a Macbook. It's frustrating that I have to choose between USB-C support for the Macbook, and NFC support for the phone. It's odd that they don't make a USB-C version with NFC.
According to them, it's because "there isn't room on the USB-C devices for an NFC antenna": https://twitter.com/i/web/status/1044254654366769152
Earlier quoted context omitted.
DNA is something you are.
The reason DNA is useful as criminal evidence is you leave it everywhere; that makes it a horrible security factor: like fingerprints it's an impractical to replace wheb compromised “thing you have” that you leave everywhere for attackers.
Flicking between the comparison tables at https://www.yubico.com/products/yubikey-hardware/compare-yub... and https://www.yubico.com/products/yubikey-hardware/compare-yub... it appears like the only differences between YubiKey 4 and Yubikey 5 NFC is i) the addition of NFC and ii) the addition of FIDO 2 support The differences between Yubikey NEO and YubiKey 5 NFC appear to be i) The addition of docker login support (…
IIRC the NEO only does TOTP over NFC. It sounds like the 5 does U2F over NFC, now?
Earlier quoted context omitted.
Because one day we'd like to securely authenticate to things on phones in phone browsers. (I agree that it's not a big a deal as one may think; it only matters if you're logging in to a critical service via the browser and not the app. If you're using the app, it's the app's problem to make sure that you're talking to the Correct Service(TM), so phishing concerns go away.)
Contrary to (at least the 4 series-era) Yubico's marketing materials, their Android app works fine with USB (in fact better than with NFC), so if you have and Android phone with a USB-C port, you can plug in a USB-C Yubikey directly (or a USB-A Yubikey with an adapter). Once browsers on Android support WebAuthn, it may well be that plugging in a USB-C Yubikey will be more convenient than trying to locate the position…
Financial institution support for phones as the source of the payment tap is spotty here, but definitely growing. Contactless cards are the longer-standing way for Canadians to use this method.
I think the YK5's biggest problem is that the YK Neo and 4, which have been out for years, were already so good. Unless you really care about NFC at the same time as RSA-4096, I'm not sure I see a big impetus to upgrade. Hopefully the USB-C line won't be plagued with supply issues. WebAuthn is mostly boring and I think that's mostly a good thing. I'm glad that there's a way to evolve the spec. Some of the changes are…
I'd say YK5 is in "mature"/"stability" product cycle, what means it is good time to buy it whether you haven't yet purchased any MFA key.
It is annoying you have to choose between USB-C and NFC. I was really hoping I could have both in a new device. I have a 4C and think it is great - the only downside is the lack of NFC and that only a subset of sites support it, but more are implementing it as time goes on. I'll probably pick up a 5 as one to store on a keyring for mostly NFC use.
Just replied in another thread: it's a few months away, but we'll have usb-c + nfc in Solo (open source security key supporting FIDO2). We'll launch the Kickstarter next week: https://solokeys.com
I use four devices regularly: a Windows desktop with USB, an MBP with USB-C, a 6th Gen iPad (Lightning), and an iPhone X (Lightning + NFC).
What I'd really like to see is a small device that lets me use USB, USB-C, Lightning, or NFC with the same token without a handful of dongles to deal with. I get how difficult that is, but I've yet to see anything that supports more than one physical standard. Even USB and USB-C in the same device would solve most of my problem, leaving only my iPad to deal with a dongle due to its lack of NFC.
Earlier quoted context omitted.
The spec doesn't insist on it, but that's how Yubico devices do it, yes. It's the straightforward thing to do when your scheme eventually relies on ECDH and there's an obvious and performant way to go from a base secret to a specific-use secret (via a KDF, here HMAC) to a public key (via scalarmult). It'd be less straightforward if your key generation is expensive and complicated.
If I'm understand correctly, the resident keys can be used in the case of a non-ECDH scheme and otherwise they wouldn't be used? How flexible is the FIDO2 specification on crypto schemes?
WebAuthn adds a number of crypto schemes -- to wit, I think they add RSA. You can certainly deterministically generate RSA keys but it's a lot more of a pain in the neck than x = HMAC(k, "u2f" + custom); P = xG :)
Earlier quoted context omitted.
Wait, seriously? Not even the OpenPGP applet/with ykman configuration? In what modes does it do that? That’s send-it-back bad.
Certainly for the OpenPGP applet, require touch to sign/auth/enc was introduced with the Yubikey 4. For U2F touch is always required and you do get an option on the NEO to require touch for Yubico challenge/response. Not sure about the PIV or TOTP applets.