4 ms·

How does one use a U2F / YubiKey on a mobile device like an iPhone (lightning port), or are they only compatible with laptops and Android phones (USB-2, USB-C,

How does one use a U2F / YubiKey on a mobile device like an iPhone (lightning port), or are they only compatible with laptops and Android phones (USB-2, USB-C, USB-3) connections?

sumitgt 8y ago
There is a NFC Yubikey which you can tap against your phone to log in. There is also a bluetooth version which is not manufactured by Yubikey. https://www.amazon.com/dp/B01LYV6TQM/?coliid=I3IA8VD7QRRZDT&colid=A3T6TCVLX696&psc=0&ref_=lv_ov_lig_dp_it https://www.amazon.com/dp/B01LYV6TQM/?coliid=I3IA8VD7QRRZDT&...
smiley1437 8y ago
You have to get the version that works on mobile (Neo?) which uses NFC to connect to the phone. It works properly on Android. Due to some restrictions from Apple it doesn't work well on IOS yet: https://www.yubico.com/2017/10/iphone-support-yubikey-otp-via-nfc/ https://www.yubico.com/2017/10/iphone-support-yubikey-otp-vi...
Steltek 8y ago
On Android, you have plenty of options and they all work. Specifically, my Neo key works with NFC and my YK4 works with USB OTG (both original flavor and USB-C). Apple limits the capabilities of Yubikeys so much that it's best to summarize it as "Doesn't work". It's more of Apple's anti-competitive restrictions that seem to go unnoticed by most people because they have a shiny UI.
- adrian_mrd 8y ago
  Thanks for that info. So, then, if Apple wanted to adopt a similar solution to Google - i.e. for their own enterprise security, as opposed to for their customers - could they use one of the Yubikey NFC options, or, would they have to ‘create’ a Bluetooth-specific device? Maybe the long-rumoured Steve Jobs ring could take the form factor?! And from an Apple customer perspective, is there a valid argument to be made that iOS devices can be, or are currently, less secure than Android counterparts because of the current lack of Yubikey / U2F options?
  - PascLeRasc 8y ago
    The Yubikey NEO recently supports iPhone 7 and up: https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-mobile-sdk-for-ios-and-lastpass-support/ https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-...
    - adrian_mrd 8y ago
      With some limitations, at least in iOS 11: “Besides the fact that the NFC Reader interface can only be fired up from an app, Core NFC [in iOS 11] does not allow for write operations that are required for authentication protocols like FIDO U2F. ... However, because NFC tag reading is supported, it allows developers to build apps, including consumer facing or purpose-built enterprise applications, with one-time passcode (OTP) support.” Which is what ‘smiley1437’ and others have effectively stated in other parts of this thread. edit: added last sentence
closeparen 8y ago
iPhones and high-end Androids have their own secure elements these days. I’d expect the OSes will eventually provide their own hardware-backed U2F APIs that you enroll directly, rather than piggybacking tokens. Same for corporate laptops with TPMs.
- adrian_mrd 8y ago
  Good point, that makes a lot of sense with Apple’s hardware strategy in mind.
bduerst 8y ago
People already mentioned the NFC, but you can also use the key on another secured device (w/ USB) to generate an OTP for the phone login. This still requires using the key to get the temporary OTP.
djrogers 8y ago
I asked the same question earlier, then found out that Yubikeys can work with a lightning-USB adapter. [1]https://support.yubico.com/support/solutions/articles/15000006479-getting-started-on-ios https://support.yubico.com/support/solutions/articles/150000...
- adrian_mrd 8y ago
  Thanks, good to know. Again iOS 11 only supports the One-time password (OTP) featureset: “When a YubiKey is connected to an iOS device, only the OTP mode functions listed below are available. Yubico OTP Static Password OATH-HOTP” Does anyone know if iOS 12 will update Core NFC to overcome: “Core NFC [in iOS 11] does not allow for write operations that are required for authentication protocols like FIDO U2F.” [1] https://www.yubico.com/2017/10/iphone-support-yubikey-otp-via-nfc/ https://www.yubico.com/2017/10/iphone-support-yubikey-otp-vi...
mimming 8y ago
The protocol specifics 3 transport options with this in mind: usb, nfc, and Bluetooth. As others mention, nfc works great for android. Bluetooth is your only option for iOS, and it’s clunky because you have to deal with pairing.
- deleted 8y ago
  [deleted]

How does one use a U2F / YubiKey on a mobile device like an iPhone (lightning port), or are they only compatible with laptops and Android phones (USB-2, USB-C, USB-3) connections?

sumitgt 8y ago

There is a NFC Yubikey which you can tap against your phone to log in. There is also a bluetooth version which is not manufactured by Yubikey. https://www.amazon.com/dp/B01LYV6TQM/?coliid=I3IA8VD7QRRZDT&colid=A3T6TCVLX696&psc=0&ref_=lv_ov_lig_dp_it https://www.amazon.com/dp/B01LYV6TQM/?coliid=I3IA8VD7QRRZDT&...

smiley1437 8y ago

You have to get the version that works on mobile (Neo?) which uses NFC to connect to the phone. It works properly on Android. Due to some restrictions from Apple it doesn't work well on IOS yet: https://www.yubico.com/2017/10/iphone-support-yubikey-otp-via-nfc/ https://www.yubico.com/2017/10/iphone-support-yubikey-otp-vi...

Steltek 8y ago

On Android, you have plenty of options and they all work. Specifically, my Neo key works with NFC and my YK4 works with USB OTG (both original flavor and USB-C). Apple limits the capabilities of Yubikeys so much that it's best to summarize it as "Doesn't work". It's more of Apple's anti-competitive restrictions that seem to go unnoticed by most people because they have a shiny UI.

adrian_mrd 8y ago
Thanks for that info. So, then, if Apple wanted to adopt a similar solution to Google - i.e. for their own enterprise security, as opposed to for their customers - could they use one of the Yubikey NFC options, or, would they have to ‘create’ a Bluetooth-specific device? Maybe the long-rumoured Steve Jobs ring could take the form factor?! And from an Apple customer perspective, is there a valid argument to be made that iOS devices can be, or are currently, less secure than Android counterparts because of the current lack of Yubikey / U2F options?
- PascLeRasc 8y ago
  The Yubikey NEO recently supports iPhone 7 and up: https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-mobile-sdk-for-ios-and-lastpass-support/ https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-...
  - adrian_mrd 8y ago
    With some limitations, at least in iOS 11: “Besides the fact that the NFC Reader interface can only be fired up from an app, Core NFC [in iOS 11] does not allow for write operations that are required for authentication protocols like FIDO U2F. ... However, because NFC tag reading is supported, it allows developers to build apps, including consumer facing or purpose-built enterprise applications, with one-time passcode (OTP) support.” Which is what ‘smiley1437’ and others have effectively stated in other parts of this thread. edit: added last sentence

closeparen 8y ago

iPhones and high-end Androids have their own secure elements these days. I’d expect the OSes will eventually provide their own hardware-backed U2F APIs that you enroll directly, rather than piggybacking tokens. Same for corporate laptops with TPMs.

adrian_mrd 8y ago
Good point, that makes a lot of sense with Apple’s hardware strategy in mind.

bduerst 8y ago

People already mentioned the NFC, but you can also use the key on another secured device (w/ USB) to generate an OTP for the phone login. This still requires using the key to get the temporary OTP.

djrogers 8y ago

I asked the same question earlier, then found out that Yubikeys can work with a lightning-USB adapter. [1]https://support.yubico.com/support/solutions/articles/15000006479-getting-started-on-ios https://support.yubico.com/support/solutions/articles/150000...

adrian_mrd 8y ago
Thanks, good to know. Again iOS 11 only supports the One-time password (OTP) featureset: “When a YubiKey is connected to an iOS device, only the OTP mode functions listed below are available. Yubico OTP Static Password OATH-HOTP” Does anyone know if iOS 12 will update Core NFC to overcome: “Core NFC [in iOS 11] does not allow for write operations that are required for authentication protocols like FIDO U2F.” [1] https://www.yubico.com/2017/10/iphone-support-yubikey-otp-via-nfc/ https://www.yubico.com/2017/10/iphone-support-yubikey-otp-vi...

mimming 8y ago

The protocol specifics 3 transport options with this in mind: usb, nfc, and Bluetooth. As others mention, nfc works great for android. Bluetooth is your only option for iOS, and it’s clunky because you have to deal with pairing.

deleted 8y ago
[deleted]