4 ms·

> Yubikey support in browser (Personal) BitWarden: no huh? I use my yubikey in the Bitwarden browser extension. Otherwise, a very extensive collection of comp

> Yubikey support in browser (Personal) BitWarden: no huh? I use my yubikey in the Bitwarden browser extension. Otherwise, a very extensive collection of comparison data. Not surprised to see Bitwarden come out on top.

tmikaeld 8y ago
I'm also currently using it with a Yubikey and on personal account.
drdaeman 8y ago
"Yubikey support" is a meaningless phrase, anyway. Bitwarden supports 2FA with Yubico OTP - although there's a bug so it works only for QWERTY layouts. Or you can use Yubikey's static password feature for your master password, I guess. There's also OpenPGP Card and PIV, which, to my knowledge, is not used/supported by any password manager software except for `pass` and some compatible implementations.
- dmoy 8y ago
  No u2f support? :(
  - village-idiot 8y ago
    U2f support is badly hampered by half-assed browser support. Only chrome enables it by default, Firefox disables it by default, and no love from safari. Even LastPass in the browser uses yubico’s proprietary otp algorithm rather than u2f.
    - danieldk 8y ago
      It seems that Apple is working to add support for hardware tokens. It is all a bit vague, but the latest Safari Preview notes state [1]: Added support for CTAP HID authenticators on macOS It also gives me "Web Authentication" under "Experimental features" in the Develop menu. https://developer.apple.com/safari/technology-preview/release-notes/ https://developer.apple.com/safari/technology-preview/releas...
      - sebazzz 8y ago
        Isn't that WebAuthn suppport? That is different from U2F.
        tialaramex 8y ago
        Yes and no. U2F is basically the MVP of WebAuthn. If you're doing this today you should ignore U2F and just implement WebAuthn. Firefox has WebAuthn out of the box, and there's a hack behind a pref to half-arse U2F if you still need that.
        StavrosK 8y ago
        It doesn't, though. I've been trying to implement WebAuthn and, as far as I know, CTAP 2 doesn't work on any browser yet.
    - dbrgn 8y ago
      U2F support in Firefox should work out of the box if the developers use the WebAuthn API and not the old JS library: https://hacks.mozilla.org/2018/01/using-hardware-token-based-2fa-with-the-webauthn-api/ https://hacks.mozilla.org/2018/01/using-hardware-token-based...
      - village-idiot 8y ago
        That was not my experience on google and github.
        jik 8y ago
        Google and Github both built their U2F support for Firefox before WebAuthn was released, and as you've pointed out, the U2F support in Firefox is gated out by default. Presumably Google, Github, and other companies that coded to U2F will migrate to WebAuthn eventually.
jik 8y ago
Yes, my initial evaluation was flawed because I was looking at the free version of Bitwarden, but supports neither U2F nor attachments, but the evaluation grid said that it didn't support U2F but did support attachments. I've updated the grid to fix this. It now says that YubiKey is supported for Bitwarden and has a separate pricing line for personal use without attachments or YubiKey vs. with them.

tmikaeld 8y ago

I'm also currently using it with a Yubikey and on personal account.

drdaeman 8y ago

"Yubikey support" is a meaningless phrase, anyway. Bitwarden supports 2FA with Yubico OTP - although there's a bug so it works only for QWERTY layouts. Or you can use Yubikey's static password feature for your master password, I guess. There's also OpenPGP Card and PIV, which, to my knowledge, is not used/supported by any password manager software except for `pass` and some compatible implementations.

dmoy 8y ago
No u2f support? :(
- village-idiot 8y ago
  U2f support is badly hampered by half-assed browser support. Only chrome enables it by default, Firefox disables it by default, and no love from safari. Even LastPass in the browser uses yubico’s proprietary otp algorithm rather than u2f.
  - danieldk 8y ago
    It seems that Apple is working to add support for hardware tokens. It is all a bit vague, but the latest Safari Preview notes state [1]: Added support for CTAP HID authenticators on macOS It also gives me "Web Authentication" under "Experimental features" in the Develop menu. https://developer.apple.com/safari/technology-preview/release-notes/ https://developer.apple.com/safari/technology-preview/releas...
    - sebazzz 8y ago
      Isn't that WebAuthn suppport? That is different from U2F.
      - tialaramex 8y ago
        Yes and no. U2F is basically the MVP of WebAuthn. If you're doing this today you should ignore U2F and just implement WebAuthn. Firefox has WebAuthn out of the box, and there's a hack behind a pref to half-arse U2F if you still need that.
        StavrosK 8y ago
        It doesn't, though. I've been trying to implement WebAuthn and, as far as I know, CTAP 2 doesn't work on any browser yet.
  - dbrgn 8y ago
    U2F support in Firefox should work out of the box if the developers use the WebAuthn API and not the old JS library: https://hacks.mozilla.org/2018/01/using-hardware-token-based-2fa-with-the-webauthn-api/ https://hacks.mozilla.org/2018/01/using-hardware-token-based...
    - village-idiot 8y ago
      That was not my experience on google and github.
      - jik 8y ago
        Google and Github both built their U2F support for Firefox before WebAuthn was released, and as you've pointed out, the U2F support in Firefox is gated out by default. Presumably Google, Github, and other companies that coded to U2F will migrate to WebAuthn eventually.

jik 8y ago

Yes, my initial evaluation was flawed because I was looking at the free version of Bitwarden, but supports neither U2F nor attachments, but the evaluation grid said that it didn't support U2F but did support attachments. I've updated the grid to fix this. It now says that YubiKey is supported for Bitwarden and has a separate pricing line for personal use without attachments or YubiKey vs. with them.