YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
1–10 of 62 posts
Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
#2If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password).
Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all.
I trust the secure element on the iPhone a lot more than I trust the hardware on the Yubikey.
The days are numbered for this whole idea of a separate piece of hardware USB/NFC to do authentication. If I’m adding a “something I have” factor to my authentication flow (or even making it the only factor) it’s going to be the phone hardware itself, not an extra dongle thing I have to carry around.
FIDO’s upcoming CTAP unfortunately is going about it the wrong way, IMO. I don’t want to have to establish NFC or Bluetooth from my iPhone to my desktop to enable me to use my iPhone to authenticate on my desktop. It’s entirely unnecessary since both devices are already online. They are designing for a corner case which makes the primary case too complicated.
Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
#3If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
Do iPhones allow access to the underlying TPM devices?
I personally don't believe things like Google Authenticator are a good "something you have" second factor as the "something you have" is just a string stored in a sqlite database. Much easier to covertly copy that than a hardware key where the string is burned into the key.
Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
#4Yubikey OTP is much weaker than a good challenge-response protocol like U2F. I assume that Yubico is supporting OTP because iOS only exposes NDEF data, and NDEF is effectively a one-way protocol.
Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
#5Yubikey OTP is much weaker than a good challenge-response protocol like U2F. I assume that Yubico is supporting OTP because iOS only exposes NDEF data, and NDEF is effectively a one-way protocol.
Allowing two way communication would permit innovation in connecting devices that are not subject to Apple's direct control.
Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
#6[deleted]
Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
#7If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
Another neat solution: https://krypt.co/
Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
#8Ok, this is dumb. Real dumb. I would trust (the leaked) secure enclave OS than Yubico's offerings. And the Secure Enclave is already built in, versus this 3rd party hardware.
Also, using something like andOTP is perfectly fine to run, which is also a U2F TOTP solution. It integrates perfectly with LinOTP, Google Authenticatior, or other 2fa solutions.
In essence, if you're using Linux anywhere, 2fa is free to implement, free to manage serverside, and just works. There's no reason for Yubi-anything.
Also, within the next few weeks/months, NIST will be stating that phone calls, Texts, and emails are no longer an acceptable 2fa for secure stuff.
Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
#9If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
Do iPhones allow access to the underlying TPM devices? I personally don't believe things like Google Authenticator are a good "something you have" second factor as the "something you have" is just a string stored in a sqlite database. Much easier to covertly copy that than a hardware key where the string is burned into the key.
I don't think theres much value in "something you have" so much as there's value in "approving this authentication via another device". Adding an additional device to compromise running an entirely different platform makes attacks much more difficult, even if we're talking about a poorly secured Windows machine and outdated Android phone. Enough to make you effectively invulnerable to almost all non-targeted attacks which will only breach one side or the other.
Re: YubiKey comes to the iPhone with Mobile SDK for iOS and LastPass support
#10If I’m authenticating with “something I have” then why not use the iPhone itself which also happens to add a layer of “something I am” (FaceID) as well as easily supporting entry of something I know (PIN or password). Using a hardware token to authenticate to an app on an iPhone makes about as much sense as.... sorry, it makes absolutely no sense at all. I trust the secure element on the iPhone a lot more than I trus…
Do iPhones allow access to the underlying TPM devices? I personally don't believe things like Google Authenticator are a good "something you have" second factor as the "something you have" is just a string stored in a sqlite database. Much easier to covertly copy that than a hardware key where the string is burned into the key.
Yes, iPhones allow storing data that can’t leave the device. Otherwise OTP apps would be pointless.
I don’t know the details, but some apps use it to store OTP secrets. Eg. if you use the DUO app, your secrets will be backed up, but they can only be restored on your phone. (was quite a hassle to reset 2FA on all the websites after my phone was replaced in warranty repair)
Not sure what Google authenticator does.