4 ms·
The feature the 4 has which the Neo doesn't which matters most to me is 'touch to confirm key operation' when used via USB. I'm quite surprised how little this
by tomatocracy 8y ago
The feature the 4 has which the Neo doesn't which matters most to me is 'touch to confirm key operation' when used via USB. I'm quite surprised how little this seems to be known - a hardware key which will sign anything a potential piece of malware or malicious actor asks for without question (assuming said malware is able to steal the PIN or get access to the appropriate agent socket which is not too much of a stretch) is a lesser improvement over pure software keys (sure, you can get the same effect by plugging and unplugging but thats a pain).
On the other hand, NFC is pretty much essential to me for use on an android phone. If this has both then I will look carefully at upgrading.
- lvh 8y agoWait, seriously? Not even the OpenPGP applet/with ykman configuration? In what modes does it do that? That’s send-it-back bad.
- tomatocracy 8y agoCertainly for the OpenPGP applet, require touch to sign/auth/enc was introduced with the Yubikey 4. For U2F touch is always required and you do get an option on the NEO to require touch for Yubico challenge/response. Not sure about the PIV or TOTP applets.
- lvh 8y agoDang, TIL; I could've sworn I've made that work on a NEO. PIV mode presumably also has forced touch/reauth for signing?
- patcheudor 8y agoThis makes sense for enterprise uses where an organization wants to keep private key material off a server, but don't want to spend the money for a enterprise security key manager.
- tomatocracy 8y agoYes - I'm not saying it shouldn't be possible to configure it that way but it is not great that (at least for OpenPGP) there's no way to set it to require physical interaction to gain access to key functions on the NEO.