5 ms·

Flicking between the comparison tables at https://www.yubico.com/products/yubikey-hardware/compare-yubikeys/ https://www.yubico.com/products/yubikey-hardware/c

Flicking between the comparison tables at https://www.yubico.com/products/yubikey-hardware/compare-yubikeys/ https://www.yubico.com/products/yubikey-hardware/compare-yub... and https://www.yubico.com/products/yubikey-hardware/compare-yubikey-4-neo/ https://www.yubico.com/products/yubikey-hardware/compare-yub... it appears like the only differences between YubiKey 4 and Yubikey 5 NFC is i) the addition of NFC and ii) the addition of FIDO 2 support The differences between Yubikey NEO and YubiKey 5 NFC appear to be i) The addition of docker login support (?!); ii) FIDO 2; iii) RSA 4096 (PGP) support and iv) ECC p384 (not in PGP) support. With that in mind.... how widely is FIDO2 deployed? I haven't yet found a two factor app supporting app/site that doesn't support my Yubikey 4.

arusahni 8y ago
IIRC the NEO only does TOTP over NFC. It sounds like the 5 does U2F over NFC, now?
- lambada 8y ago
  Oh, interesting! That's not called out on their comparison chart for the NEO. That would certainly be a tempting upgrade for any NEO users then
  - anilakar 8y ago
    Now I've only got one problem remaining: how do I upgrade my old U2F-capable NEO on all the websites? Do I have to keep it with me ad infinitum? I cannot really destroy it either, as I cannot be 100 % sure I've remembered to enroll my new Yubikey 5. This raises a more generic question: What's the proper upgrade path for hardware authentication tokens?
    - albuic 8y ago
      > This raises a more generic question: What's the proper upgrade path for hardware authentication tokens? This is the reason why I'm still using only a password manager. I agree that a hardware token more security but the lost/stolen/change key problem is really not easy right now. I hope there will be a new common API to change all enrollment you have done but it seems hard as the key don't even know them. Maybe in a future version ?
- emlun 8y ago
  NEO also does OpenPGP over NFC on Android. iOS only recently started opening up NFC to non-Apple developers.
- zhongfu 8y ago
  U2F over NFC works on the NEO; I've been able to login to GitHub through Chrome with the Google Authenticator Android app. Same with Google account login on Android when adding an account to the device
- simcop2387 8y ago
  The neo doesn't do totp at all (nfc or otherwise). It will do hotp, fixed response, and a challenge-response mode over nfc. It might do more but I haven't used them. I'm currently using the challenge response with keepassxc over USB and keepass2android over nfc. It's been working great
deleted 8y ago
[deleted]
Leace 8y ago
5 is like a merger of NEO and 4, NEO has NFC and 4 has 4096 RSA keys. And then there is FIDO2 but until it's in widespread usage U2F works fine.
Asturaz 8y ago
The only one with Fido2 at the moment I know is Microsoft Outlook/Office365.

arusahni 8y ago

IIRC the NEO only does TOTP over NFC. It sounds like the 5 does U2F over NFC, now?

lambada 8y ago
Oh, interesting! That's not called out on their comparison chart for the NEO. That would certainly be a tempting upgrade for any NEO users then
- anilakar 8y ago
  Now I've only got one problem remaining: how do I upgrade my old U2F-capable NEO on all the websites? Do I have to keep it with me ad infinitum? I cannot really destroy it either, as I cannot be 100 % sure I've remembered to enroll my new Yubikey 5. This raises a more generic question: What's the proper upgrade path for hardware authentication tokens?
  - albuic 8y ago
    > This raises a more generic question: What's the proper upgrade path for hardware authentication tokens? This is the reason why I'm still using only a password manager. I agree that a hardware token more security but the lost/stolen/change key problem is really not easy right now. I hope there will be a new common API to change all enrollment you have done but it seems hard as the key don't even know them. Maybe in a future version ?
emlun 8y ago
NEO also does OpenPGP over NFC on Android. iOS only recently started opening up NFC to non-Apple developers.
zhongfu 8y ago
U2F over NFC works on the NEO; I've been able to login to GitHub through Chrome with the Google Authenticator Android app. Same with Google account login on Android when adding an account to the device
simcop2387 8y ago
The neo doesn't do totp at all (nfc or otherwise). It will do hotp, fixed response, and a challenge-response mode over nfc. It might do more but I haven't used them. I'm currently using the challenge response with keepassxc over USB and keepass2android over nfc. It's been working great

deleted 8y ago

[deleted]

Leace 8y ago

5 is like a merger of NEO and 4, NEO has NFC and 4 has 4096 RSA keys. And then there is FIDO2 but until it's in widespread usage U2F works fine.

Asturaz 8y ago

The only one with Fido2 at the moment I know is Microsoft Outlook/Office365.