9 ms·

I have long debated getting a Yubikey but have held off because I don't want to have to carry around several dongles at all times to be able to send an email.

I have long debated getting a Yubikey but have held off because I don't want to have to carry around several dongles at all times to be able to send an email. Surely other people are in the situation of: - iPhone, iPad - Macbook with only USB-C ports - Windows/Linux workstation with only USB-A ports Is there currently a non-cumbersome solution that will work on all of these?

kitten_smuggler 7y ago
A bluetooth capable U2F device like the Titan.
- dickeytk 7y ago
  you can't use that with computers. You have to use a dongle + cable to connect to new macbook pros
  - anonuser123456 7y ago
    I use it on my laptop daily.
- kevin_nisbet 7y ago
  https://solokeys.com https://solokeys.com are an option as well if you like open hardware. https://github.com/solokeys/solo https://github.com/solokeys/solo I think the NFC ones are shipping after they worked out some kinks.
  - vanadium 7y ago
    Just got mine last week (Solo, Solo Tap, and the DigiPass SecureClick). All work great for their respective uses.
  - baq 7y ago
    I have three ordinary solos. Work great.
- cbhl 7y ago
  Friendly reminder that "T1" Bluetooth Titan keys were recalled last month; they don't work with iOS 12.3+. Details are available at https://security.googleblog.com/2019/05/titan-keys-update.html https://security.googleblog.com/2019/05/titan-keys-update.ht...
AdmiralAsshat 7y ago
I tried to get mine as future-proof as possible, but I was left with a choice of either getting the Yubikey Neo with NFC or a Yubikey with USB-C. I went with the Neo, because it supports all of my current devices, and for USB-C future testing, I tested it on my phone with an USB A-C adapter and it worked there as well. I'm a Linux/Android user without any Apple devices, though, so YMMV. EDIT: Should also mention that I received a free basic Yubikey as a gift for subscribing to Ars Technica about a year ago. USB-to-MicroUSB and USB-to-C adapters worked on that for all of my devices, as well. I feel pretty confident switching to Yubikeys now that I have two and can keep the newish one on my keychain at all times, with the basic one in a secure place at home.
- rstuart4133 7y ago
  > I tried to get mine as future-proof as possible I don't think that's possible right now. Until they come up with a solution to "I've lost my 2fa token" that isn't as painful as losing you wallet there will be new designs coming out. (Actually, it's more painful. You only have a few cards in your wallet, while your 2fa token may be recognised by 100's of sites.) This isn't a criticism of FIDO2/WebAuthn. I am impressed by how each iteration solves a new part of the problem, and FIDO2 was definitely a step forward, fixing rough edges in FIDO. But we aren't there yet. We need a FIDO3 and possibly 4, 5 and 6.
  - AdmiralAsshat 7y ago
    Having a backup 2FA token seems like a solution, no? As I already said, I've got a lower-end Yubikey that is basically only there to be a backup in case of emergencies.
    - rstuart4133 7y ago
      To be honest I didn't understand your backup strategy. As far as I'm aware it isn't possible to clone a key - and I sincerely hope that's true. If you can't clone it the only other way I can think of using a backup is having every site you log into accept two so you can authenticate with either - but I've never noticed a site that can do that. Assuming it's the "authenticate with either" solution, it ain't a great solution. If you have to replace a key you still have to visit every site you authenticate with and provide you new key. Looking at my password manager that seems to mean 100's of sites in my case. There are lots of potential solutions to the "dog eat my token" that don't require me to visit every site I authenticate with - or even notify them. Online servers can even handle the "someone stole my token" case. Right now the only deployed online solution we have is OAuth, which really an authorisation mechanism. It sucks at for authentication.
izacus 7y ago
Usually you just use multiple keys - one USB-C in the MacBook, one tiny USB-A in the laptop and the built-in Titan key in the Pixel phone. You don't remove them.
- jiveturkey 7y ago
  few providers support enrolling multiple yubikeys into your account.
  - cbhl 7y ago
    This is true, and it is dangerous (once the key fails, folks get locked out). I don't use security keys with such providers. It would be nice if someone made a library that made incorporating Webauthn login into an app as simple as using django or Ruby on Rails or React to create a login form, so folks don't end up rolling their own and assuming that a user will have at most one yubikey. Failing that, you could do what Zeit does and rely on email providers' support for Security Keys (login by email link only).
  - Operyl 7y ago
    Which don't? For all the big major ones I've used U2F with, they've supported multiple keys for a while (or since introduction). It's practically a requirement in case you lose a key.. To name a few off the top of my head: Google, GitHub, Gitlab, Facebook, 1Password, etc.
    - zippergz 7y ago
      Vanguard (where my company has their 401k plan) is one I have encountered that only supports a single Yubikey.
      - bitskits 7y ago
        Not sure when you last checked, Vanguard supports up to 4 security keys.
jiveturkey 7y ago
krypton (https://krypt.co/ https://krypt.co/). If you're ok with one dongle, you can get the A or C flavor of a yubikey neo and keep a converter permanently in the other devices.
cbhl 7y ago
The way $dayjob makes this work is to issue a nano security key for each computer, and then a bluetooth security key for the iPhone (Android phones can use both NFC and Bluetooth security keys, but iPhones can only use Bluetooth security keys). It's cumbersome, but less so than when we were plugging and unplugging our one hardware USB-A OTP token into everything (and using a desktop web browser to generate OTPs for the phones). If you do end up getting a security key, I recommend getting at least two. If one fails, you'll want the other one as a backup so that you can get back into your accounts.
- bad_user 7y ago
  What happens if your house burns down with everything in it? You’d then have to contact support to let you bypass 2FA, but if that’s possible then the 2FA protection is weak, prone to social hacking.
  - lstamour 7y ago
    If I keep one with me and one at home, then I only have to worry about leaving both at home if I’m caught in the fire. Additionally, if I can prove who I am in person, or via friends attestations or both, that’s a lot better than a forgot password form or SMS hijacking.
    - deleted 7y ago
      [deleted]
  - saltminer 7y ago
    I keep an extra Yubikey in my bank box, next to my other backup keys. The only account I'd be locked out of is Twitter since they only let you add 1 token (my primary).
    - stingraycharles 7y ago
      AWS also only allows you to add a single device, much to my annoyance. I still haven’t found a solution for that, that doesn’t involve risking getting locked out.
currymj 7y ago
so it appears, no, all reasonable solutions are quite cumbersome for the time being, for an individual who wants to use many accounts anyway. a company might be able to cook up a system that works well for its employees though.
jwr 7y ago
Either the USB-A dongle or the USB-C one should work in all of these cases with an additional dongle (sigh). By the way: I recommend getting the larger keys, not the nanos. These nanos look cute, but especially the newer ones are intended to be fixed to one device permanently, which in my opinion is both inconvenient and not the intended usage. I wonder if iPad apps will start supporting Yubikeys — especially with the new iPad pros and their USB-C port it seems natural. Ideally, I'd love to see Blink integrate ssh-agent, gpg-agent and its card support, which would let me use my existing (excellent) setup for using GPG keys stored on a Yubikey for ssh (see https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide for a great writeup of this approach).
brightball 7y ago
The new Yubikey's with NFC support work on my 2 year old iPhone already.
- jwr 7y ago
  Which apps support it? Can you use it for any of the online services?
  - brightball 7y ago
    I just tried it for the first time with the Bitwarden app.
- dwaite 7y ago
  That is Yubikey OTP support, not FIDO/U2F.
kop316 7y ago
Fastmail uses app passwords, and I used that for my phone/tablet.
abstractbarista 7y ago
I guess one solution is to use hardware that takes connector compatibility more seriously. I only use stuff with USB-A, and the Yubikey works with my phone via NFC (Yubico's Neo model). Similarly, my laptop has an SD card reader and Ethernet port. My laptop and phone have 3.5mm jacks. All my small devices use micro-USB. No dongles or adapters makes for seamless usage. I guess the only 'adapter' is keeping a micro-USB -> USB-A cable around.
ecesena 7y ago
Given that you likely also have cable adapters and you need 1 primary key + 1 backup anyway, my recommendation would be to buy 1 usb-a and 1 usb-c. Or you can make your own :) iPhone/iPad is currently not solved, hopefully with iOS 13 we'll see positive news.

kitten_smuggler 7y ago

A bluetooth capable U2F device like the Titan.

dickeytk 7y ago
you can't use that with computers. You have to use a dongle + cable to connect to new macbook pros
- anonuser123456 7y ago
  I use it on my laptop daily.
kevin_nisbet 7y ago
https://solokeys.com https://solokeys.com are an option as well if you like open hardware. https://github.com/solokeys/solo https://github.com/solokeys/solo I think the NFC ones are shipping after they worked out some kinks.
- vanadium 7y ago
  Just got mine last week (Solo, Solo Tap, and the DigiPass SecureClick). All work great for their respective uses.
- baq 7y ago
  I have three ordinary solos. Work great.
cbhl 7y ago
Friendly reminder that "T1" Bluetooth Titan keys were recalled last month; they don't work with iOS 12.3+. Details are available at https://security.googleblog.com/2019/05/titan-keys-update.html https://security.googleblog.com/2019/05/titan-keys-update.ht...

AdmiralAsshat 7y ago

I tried to get mine as future-proof as possible, but I was left with a choice of either getting the Yubikey Neo with NFC or a Yubikey with USB-C. I went with the Neo, because it supports all of my current devices, and for USB-C future testing, I tested it on my phone with an USB A-C adapter and it worked there as well. I'm a Linux/Android user without any Apple devices, though, so YMMV. EDIT: Should also mention that I received a free basic Yubikey as a gift for subscribing to Ars Technica about a year ago. USB-to-MicroUSB and USB-to-C adapters worked on that for all of my devices, as well. I feel pretty confident switching to Yubikeys now that I have two and can keep the newish one on my keychain at all times, with the basic one in a secure place at home.

rstuart4133 7y ago
> I tried to get mine as future-proof as possible I don't think that's possible right now. Until they come up with a solution to "I've lost my 2fa token" that isn't as painful as losing you wallet there will be new designs coming out. (Actually, it's more painful. You only have a few cards in your wallet, while your 2fa token may be recognised by 100's of sites.) This isn't a criticism of FIDO2/WebAuthn. I am impressed by how each iteration solves a new part of the problem, and FIDO2 was definitely a step forward, fixing rough edges in FIDO. But we aren't there yet. We need a FIDO3 and possibly 4, 5 and 6.
- AdmiralAsshat 7y ago
  Having a backup 2FA token seems like a solution, no? As I already said, I've got a lower-end Yubikey that is basically only there to be a backup in case of emergencies.
  - rstuart4133 7y ago
    To be honest I didn't understand your backup strategy. As far as I'm aware it isn't possible to clone a key - and I sincerely hope that's true. If you can't clone it the only other way I can think of using a backup is having every site you log into accept two so you can authenticate with either - but I've never noticed a site that can do that. Assuming it's the "authenticate with either" solution, it ain't a great solution. If you have to replace a key you still have to visit every site you authenticate with and provide you new key. Looking at my password manager that seems to mean 100's of sites in my case. There are lots of potential solutions to the "dog eat my token" that don't require me to visit every site I authenticate with - or even notify them. Online servers can even handle the "someone stole my token" case. Right now the only deployed online solution we have is OAuth, which really an authorisation mechanism. It sucks at for authentication.

izacus 7y ago

Usually you just use multiple keys - one USB-C in the MacBook, one tiny USB-A in the laptop and the built-in Titan key in the Pixel phone. You don't remove them.

jiveturkey 7y ago
few providers support enrolling multiple yubikeys into your account.
- cbhl 7y ago
  This is true, and it is dangerous (once the key fails, folks get locked out). I don't use security keys with such providers. It would be nice if someone made a library that made incorporating Webauthn login into an app as simple as using django or Ruby on Rails or React to create a login form, so folks don't end up rolling their own and assuming that a user will have at most one yubikey. Failing that, you could do what Zeit does and rely on email providers' support for Security Keys (login by email link only).
- Operyl 7y ago
  Which don't? For all the big major ones I've used U2F with, they've supported multiple keys for a while (or since introduction). It's practically a requirement in case you lose a key.. To name a few off the top of my head: Google, GitHub, Gitlab, Facebook, 1Password, etc.
  - zippergz 7y ago
    Vanguard (where my company has their 401k plan) is one I have encountered that only supports a single Yubikey.
    - bitskits 7y ago
      Not sure when you last checked, Vanguard supports up to 4 security keys.

jiveturkey 7y ago

krypton (https://krypt.co/ https://krypt.co/). If you're ok with one dongle, you can get the A or C flavor of a yubikey neo and keep a converter permanently in the other devices.

cbhl 7y ago

The way $dayjob makes this work is to issue a nano security key for each computer, and then a bluetooth security key for the iPhone (Android phones can use both NFC and Bluetooth security keys, but iPhones can only use Bluetooth security keys). It's cumbersome, but less so than when we were plugging and unplugging our one hardware USB-A OTP token into everything (and using a desktop web browser to generate OTPs for the phones). If you do end up getting a security key, I recommend getting at least two. If one fails, you'll want the other one as a backup so that you can get back into your accounts.

bad_user 7y ago
What happens if your house burns down with everything in it? You’d then have to contact support to let you bypass 2FA, but if that’s possible then the 2FA protection is weak, prone to social hacking.
- lstamour 7y ago
  If I keep one with me and one at home, then I only have to worry about leaving both at home if I’m caught in the fire. Additionally, if I can prove who I am in person, or via friends attestations or both, that’s a lot better than a forgot password form or SMS hijacking.
  - deleted 7y ago
    [deleted]
- saltminer 7y ago
  I keep an extra Yubikey in my bank box, next to my other backup keys. The only account I'd be locked out of is Twitter since they only let you add 1 token (my primary).
  - stingraycharles 7y ago
    AWS also only allows you to add a single device, much to my annoyance. I still haven’t found a solution for that, that doesn’t involve risking getting locked out.

currymj 7y ago

so it appears, no, all reasonable solutions are quite cumbersome for the time being, for an individual who wants to use many accounts anyway. a company might be able to cook up a system that works well for its employees though.

jwr 7y ago

Either the USB-A dongle or the USB-C one should work in all of these cases with an additional dongle (sigh). By the way: I recommend getting the larger keys, not the nanos. These nanos look cute, but especially the newer ones are intended to be fixed to one device permanently, which in my opinion is both inconvenient and not the intended usage. I wonder if iPad apps will start supporting Yubikeys — especially with the new iPad pros and their USB-C port it seems natural. Ideally, I'd love to see Blink integrate ssh-agent, gpg-agent and its card support, which would let me use my existing (excellent) setup for using GPG keys stored on a Yubikey for ssh (see https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide for a great writeup of this approach).

brightball 7y ago

The new Yubikey's with NFC support work on my 2 year old iPhone already.

jwr 7y ago
Which apps support it? Can you use it for any of the online services?
- brightball 7y ago
  I just tried it for the first time with the Bitwarden app.
dwaite 7y ago
That is Yubikey OTP support, not FIDO/U2F.

kop316 7y ago

Fastmail uses app passwords, and I used that for my phone/tablet.

abstractbarista 7y ago

I guess one solution is to use hardware that takes connector compatibility more seriously. I only use stuff with USB-A, and the Yubikey works with my phone via NFC (Yubico's Neo model). Similarly, my laptop has an SD card reader and Ethernet port. My laptop and phone have 3.5mm jacks. All my small devices use micro-USB. No dongles or adapters makes for seamless usage. I guess the only 'adapter' is keeping a micro-USB -> USB-A cable around.

ecesena 7y ago

Given that you likely also have cable adapters and you need 1 primary key + 1 backup anyway, my recommendation would be to buy 1 usb-a and 1 usb-c. Or you can make your own :) iPhone/iPad is currently not solved, hopefully with iOS 13 we'll see positive news.