4 ms·
They provide software that you install to configure your device. I haven't used it personally (my Neo 5 is being delivered), but they've done a pretty good job
by beatgammit 8y ago
They provide software that you install to configure your device. I haven't used it personally (my Neo 5 is being delivered), but they've done a pretty good job of making it easy.
The biggest problems are:
- limited selection of sites that support U2F
- U2F is off by default in Firefox (it's a little buggy apparently)
- somewhat expensive ($45 for Yubikey Neo)
Those are getting better, and I think the Yubikey can be used OOTB (you just enable it on an existing login to prove you own it). I'll be regenerating keys, but most users probably won't bother.
- tialaramex 8y agoU2F is a legacy feature. New sites should deploy WebAuthn and existing sites should migrate, the Firefox pref override is for those remaining legacy sites. It basically bodges their WebAuthn implementation to offer a passable imitation of U2F. I don't know if a Neo can replace the secret key that makes FIDO (and thus U2F/WebAuthn) work but doing so seems pointless. If bad guys tampered with it, they presumably neutered this feature; whereas if not it's fine out of the box. Certainly Yubico's cheaper FIDO2-only product offers no way to regenerate the secret. Nobody today deploys WebAuthn to replace passwords, only as a second factor so it doesn't really undermine Troy's point, though perhaps our other countermeasures (long complicated passwords for every site, changed frequently) are less necessary if you have a good second factor like this.