5 ms·

At the risk of sounding like a complete schmuck - how do I actually use this? It look like it's a dev board, the kind of thing I'd get on SparkFun or whatever,

by Mizza 10y ago

At the risk of sounding like a complete schmuck - how do I actually use this? It look like it's a dev board, the kind of thing I'd get on SparkFun or whatever, but I get the impression it's a consumer product. Do I plug it into my computer, and it runs software? Do I press the button, then it blinks out a password via LED at me? Does it connect via bluetooth to.. something? Who writes the local software? You? Google? Me? I love your write-up and I dig your hustle, but I think the final 10% "polish" is the missing piece here! Good luck!

conorpp 10y ago
Haha good question. Yubico has a good explanation: https://www.yubico.com/products/yubikey-hardware/fido-u2f-security-key/ https://www.yubico.com/products/yubikey-hardware/fido-u2f-se... It's the same as any other U2F token. You register it with a service that supports U2F (Google, Github, Duo, etc.) and then present the token and press the button upon logging in later. No software or drivers needed. It's an HID device so all normal operating systems will support it.
- rattray 10y ago
  Ummm... can you please include an explanation on your website that makes sense to non-developers who haven't heard of either Yubico or U2F before? "It's the same as any other U2F token" is meaningless to a rather significant proportion of humanity.
  - rattray 10y ago
    Could I use this if I want to access apps on my Android phone?
    - homero 10y ago
      It's a keyboard so otg will work
deleted 10y ago
[deleted]
homero 10y ago
You push the button and it'll send 6 digits as a keyboard it's like 2fa
- sowbug 10y ago
  That's not correct. A U2F device cryptographically signs signed challenges with a key that never leaves the device. (Yes, it signs a signed challenge. That's not a typo.) The issuer of the challenge verifies both signatures to confirm that the user possesses the device and that the issuer genuinely issued the challenge embedded in the signed response. Unlike the OTP token you're describing, a U2F device is effectively stateless. And unlike an OTP token, its signing mechanism is resistant to phishing. Finally, a U2F device is not a HID keyboard, contrary to your other comment on this page. But it is a HID-compliant device.

by Mizza 10y ago

conorpp 10y ago

Haha good question. Yubico has a good explanation: https://www.yubico.com/products/yubikey-hardware/fido-u2f-security-key/ https://www.yubico.com/products/yubikey-hardware/fido-u2f-se... It's the same as any other U2F token. You register it with a service that supports U2F (Google, Github, Duo, etc.) and then present the token and press the button upon logging in later. No software or drivers needed. It's an HID device so all normal operating systems will support it.

rattray 10y ago
Ummm... can you please include an explanation on your website that makes sense to non-developers who haven't heard of either Yubico or U2F before? "It's the same as any other U2F token" is meaningless to a rather significant proportion of humanity.
- rattray 10y ago
  Could I use this if I want to access apps on my Android phone?
  - homero 10y ago
    It's a keyboard so otg will work

deleted 10y ago

[deleted]

homero 10y ago

You push the button and it'll send 6 digits as a keyboard it's like 2fa

sowbug 10y ago
That's not correct. A U2F device cryptographically signs signed challenges with a key that never leaves the device. (Yes, it signs a signed challenge. That's not a typo.) The issuer of the challenge verifies both signatures to confirm that the user possesses the device and that the issuer genuinely issued the challenge embedded in the signed response. Unlike the OTP token you're describing, a U2F device is effectively stateless. And unlike an OTP token, its signing mechanism is resistant to phishing. Finally, a U2F device is not a HID keyboard, contrary to your other comment on this page. But it is a HID-compliant device.