4 ms·

The Yubikey NEO is the only NFC device that ever got me excited. It'd be nice to be able to store all my TOTP tokens on the device instead of the phone. Also, s

The Yubikey NEO is the only NFC device that ever got me excited. It'd be nice to be able to store all my TOTP tokens on the device instead of the phone. Also, signing/encrypting text with PGP from the yubikey.

hdhzy 9y ago
Sadly there is no NFC token that supports 4096 bit RSA keys (I'm not even talking about EC keys). Fidesmo also has support for PGP/U2F over NFC.
- brians 9y ago
  That's okay. RSA-4096 is suitable for long term secrets, but we're talking about authentication: typically signing short challenges, or DH key shares, for immediate verification. The requirements for that application are much lighter.
  - hdhzy 9y ago
    How do you authenticate through NFC PGP on Android? Is that something specific to your company or is there a public app that you're using?
    - xorcist 9y ago
      You can use something called Openkeychain on Android. It uses NFC Yubikeys for both PGP and SSH. Regarding your 4096 bit requirements, normally when you have those security requirements you would keep that key offline and use shorter lived 2048 bit keys for actual authentication. There is 4096 bit support with Yubikey 4 which unfortunately isn't offered with NFC.
      - hdhzy 9y ago
        > You can use something called Openkeychain on Android. It uses NFC Yubikeys for both PGP and SSH. Okay, but open-keychain does not provide GUI to just sign or authenticate a user (you can sign as part of encryption process) so I was wondering if the parent was mentioning some application that interfaces with open Keychain (like k9mail or conversations.im) that gives just that: user authentication.
      - hdhzy 9y ago
        > There is 4096 bit support with Yubikey 4 which unfortunately isn't offered with NFC. Yes, but OTG adapters work pretty well here or one can use Yubikey 4C if the phone has USB-C input.
potatolicious 9y ago
Absolutely this. SMS 2FA has security flaws that are becoming ever more evident - U2F via NFC is a great way to authenticate on Android, and I'm looking forward to having it on iOS as well. Edit: Welp. Looking at the U2F NFC spec it looks like some exchange with the key needs to occur, so without transmit access we're boned.
- hdhzy 9y ago
  > U2F via NFC is a great way to authenticate on Android Unfortunately as far as I know only Yubikey NEO and Fidesmo card support it with Fidesmo being practically not usable. From https://www.fidesmo.com/nfc-u2f-android/ https://www.fidesmo.com/nfc-u2f-android/ : > Google’s own account security website, that on desktop allows you to register U2F devices, says that the feature is not compatible with the Chrome browser on Android. The account security site on GitHub seems to support the feature is a bit better. When pressing the button to add a token to the account it properly launches Google Authenticator to register the U2F device. When tapping the card and returning to the GitHub site however it doesn’t seem to have registered that anything has happened.

hdhzy 9y ago

Sadly there is no NFC token that supports 4096 bit RSA keys (I'm not even talking about EC keys). Fidesmo also has support for PGP/U2F over NFC.

brians 9y ago
That's okay. RSA-4096 is suitable for long term secrets, but we're talking about authentication: typically signing short challenges, or DH key shares, for immediate verification. The requirements for that application are much lighter.
- hdhzy 9y ago
  How do you authenticate through NFC PGP on Android? Is that something specific to your company or is there a public app that you're using?
  - xorcist 9y ago
    You can use something called Openkeychain on Android. It uses NFC Yubikeys for both PGP and SSH. Regarding your 4096 bit requirements, normally when you have those security requirements you would keep that key offline and use shorter lived 2048 bit keys for actual authentication. There is 4096 bit support with Yubikey 4 which unfortunately isn't offered with NFC.
    - hdhzy 9y ago
      > You can use something called Openkeychain on Android. It uses NFC Yubikeys for both PGP and SSH. Okay, but open-keychain does not provide GUI to just sign or authenticate a user (you can sign as part of encryption process) so I was wondering if the parent was mentioning some application that interfaces with open Keychain (like k9mail or conversations.im) that gives just that: user authentication.
    - hdhzy 9y ago
      > There is 4096 bit support with Yubikey 4 which unfortunately isn't offered with NFC. Yes, but OTG adapters work pretty well here or one can use Yubikey 4C if the phone has USB-C input.

potatolicious 9y ago

Absolutely this. SMS 2FA has security flaws that are becoming ever more evident - U2F via NFC is a great way to authenticate on Android, and I'm looking forward to having it on iOS as well. Edit: Welp. Looking at the U2F NFC spec it looks like some exchange with the key needs to occur, so without transmit access we're boned.

hdhzy 9y ago
> U2F via NFC is a great way to authenticate on Android Unfortunately as far as I know only Yubikey NEO and Fidesmo card support it with Fidesmo being practically not usable. From https://www.fidesmo.com/nfc-u2f-android/ https://www.fidesmo.com/nfc-u2f-android/ : > Google’s own account security website, that on desktop allows you to register U2F devices, says that the feature is not compatible with the Chrome browser on Android. The account security site on GitHub seems to support the feature is a bit better. When pressing the button to add a token to the account it properly launches Google Authenticator to register the U2F device. When tapping the card and returning to the GitHub site however it doesn’t seem to have registered that anything has happened.