17 ms·

Yubico launches its dual USB-C and Lightning two-factor security key

263 points by jeromegv 7y ago

giancarlostoro 7y ago
> Security keys offer almost unbeatable security and can protect against a variety of threats, including nation-state attackers. Alright, I'm not a security expert, but I'm not completely illiterate to basic computer security. Anyone care to chime in how this is much more secure than a two-factor app? Sure there's the obvious, nobody can just copy the two-factor app off my phone with all the codes and have the same codes (I've upgraded phones and taken my codes with me before...) but whose to stop someone from cloning a Yubico key? Again I'm not an expert, but I do want to know if this is purely marketing hype or if there's some security to Yubikey and friends that I'm not aware of. Also pardon me if I confused two-factor as the Google Authenticator app. Too many "factor" terms get a bit confusing after a while.
- Znafon 7y ago
  You can get phised to enter your two factor in a random web forms but it is not possible to do this with U2F (https://en.wikipedia.org/wiki/Universal_2nd_Factor https://en.wikipedia.org/wiki/Universal_2nd_Factor). For example, Google reported that deploying U2F blocked all phising attempts of their employees : https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu....
- knd775 7y ago
  > cloning a Yubico key This should be impossible.
  - aequitas 7y ago
    It might not be impossible, but surely non-trivial. Add to that that it has to be done in a undetectable way and the key owner needs to be parted for the key in the time it takes to make the clone.
    - Freak_NL 7y ago
      You'd probably destroy the key's shell in the process of getting to the microchip (you can't get to the private key via the USB connector by design, so decapping is probably the only way to do it), so you would have to have a clone ready that looks exactly like the key you've just disfigured to get to the secret key.
      - GoMonad 7y ago
        Moreover, if a physically undetected clone is managed, it will be detected soon through the spec. The WebAuthn spec includes monitoring an always increasing counter for each key/site pair. One of the clones will start to fail. So really there's no point in cloning. Straight up theft is the bigger concern.
- tialaramex 7y ago
  The two factor app (say, TOTP) involves a _secret_ used to generate a changing value and so bad guys can do either of two things: 1. They can steal the secret, from you or from the other party (the service you're authenticating to) 2. They can relay your answer, without knowing the secret and since the answer is genuine their relayed answer will be accepted. Example you type the One Time Code into https://fakebank.example/ https://fakebank.example/ thinking it is your bank, then the bad guys simply paste that same code into https://realbank.example https://realbank.example the actual site of your bank and it works - they get into your account. FIDO Security Keys don't use a shared secret, instead they use public key crypto. Your Security Key proves it is still the same key as it was when you registered, but the remote site doesn't have any secrets so they could even _publish_ the data they store to authenticate you and that wouldn't matter to the system's security. And it relies on the web browser to tie the FQDN into the data signed. If you press the button on the Security Key on https://fakebank.example/ https://fakebank.example/ the results are only proof for fakebank, operated by the bad guys, if they forward it to https://realbank.example/ https://realbank.example/ it won't work because the name is wrong and it doesn't match. Does that help? There are a bunch of other cool things about Security Keys, but those are the main ways it's simply better for security than a conventional TOTP-style second factor.
- mightybyte 7y ago
  > whose to stop someone from cloning a Yubico key? That is precisely what these devices are designed to stop. The device has a private key stored in hardware in a way that it cannot be retrieved by software. When you use one of these devices you dramatically decrease your number of attack vectors because now the attack has to happen physically. Someone has to actually steal your physical key. And because this is your "second factor", if that happens they still also have to have your password. Two-factor apps get closer to this, but they usually can be copied. For instance, 1Password can be set up to mimic Google Authenticator. > I do want to know if this is purely marketing hype This is most definitely NOT marketing hype. It is the current security best practice.
  - grepthisab 7y ago
    I didn't know about 1Pass, I've been a paying member for a while. I'll try that out! But to put a finer point on your actual statement, I usually screenshot the MFA setup in case my phone gets lost, so I can easily re-set it up.
    - notlukesky 7y ago
      With SAASPASS Authenticator you can set up recovery in case you lose your or change your phone.
      - eropple 7y ago
        For those who aren't aware, the author of the post works for them. Maybe a founder; it's a little hard to tell. I've run across him doing exactly this in the past. Bad form, and (having looked at it in the past) the product he's flogging is amateurish.
  - giancarlostoro 7y ago
    Impresive, have they had external security firms try to steal the private key? Thats my final thought. I guess it makes sense. By the time an adversary gets your key you would of noticed and have locked that key from your account.
- tptacek 7y ago
  Simple: security keys combat phishing, two-factor apps do not. A security key doesn't just authenticate you to a site: it also authenticates the site to you.
  - notlukesky 7y ago
    Security keys are two factor as well. In fact there are multiple different types of 2FA with different security levels. SMS 2FA is one of the weakest. Push Login is moderate. Scanning encrypted barcodes is highest and also phishing proof like FIDO keys.
    - tialaramex 7y ago
      > Scanning encrypted barcodes is highest and also phishing proof like FIDO keys. I have never seen a solution like this, but I can't see how it would avoid simple relay phish, it seems as though bad guys can just get themselves a legitimate encrypted barcode and have their victim scan it. Maybe you haven't explained this solution properly, do you have a link?
  - lxgr 7y ago
    I think I get what you are trying to express, but rather than "it authenticates the site to you", I think that should be phrased "it prevents you from authenticating at a site pretending to be some other site. evil.com can still claim to be mysite.com and trick users into using their security key there, no? It would presumably have to trick the user into "registering again" since there is no valid key handle for FIDO2 (not sure about classic U2F), but I doubt that users would notice the difference in flows. The real win is that this spoof would still not give evil.com a credential scoped to mysite.com, but a user would be none the wiser that they are on a different site than they expect (which can still be problematic depending on the nature of the site).
    - juliusmusseau 7y ago
      Suppose the key allows mysite.com to let you see your emails, send more emails, and send money to people, etc. Basically mysite.com let's you see and do interesting things after you've authed. Even if evil.com gets you to register and present your key, they cannot forward it to mysite.com. Even if they go to all the trouble to completely mitm you and the site looks identical to mysite.com, they cannot get the emails or get it to send money. This is because evil.com cannot pretend to be you when they interact with mysite.com no matter what you've given them. It's going to be hard to trick me into thinking I've logged into my gmail if none of my emails are there! Unless they somehow convince you to put your yubikey in the mail and physically send it to them...
- rurban 7y ago
  It isn't. SW can be updated and is usually open-source and mostly secure. HW not so. At least two HW backdoors have been found in chips such as this one in earlier versions, the first using an improper RSALib RSA variant (developed by NSA or Mossad). The source for the second, SCADA, is unknown. So any nation state wanting the most people to use it, will advertise it as such. "unbeatable security and can protect against a variety of threats, including nation-state attackers." This happened with the Infineon backdoor, the SCADA backdoor, the earlier Crypto AG backdoors. https://acmccs.github.io/papers/p1631-nemecA.pdf https://acmccs.github.io/papers/p1631-nemecA.pdf
  - lxgr 7y ago
    The firmware not being updateable is a desired property of most security keys, actually. At least Yubico considers the risk of compromises through firmware updates as too high: https://support.yubico.com/support/solutions/articles/15000006434-upgrading-yubikey-firmware https://support.yubico.com/support/solutions/articles/150000... Obviously they are biased – they are in the business of selling hardware, not software, but their reasoning still makes sense to me. It's arguable whether "destructive updates" that invalidate all existing registrations should be allowed, but that could have its own problems in terms of availability if not clearly communicated. On a related note, I wonder if there is actually a more secure way of preventing illegitimate firmware updates in JavaCard/GlobalPlatform than randomizing the card manager keys, which is what Yubico does for the NEO: https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
- munchbunny 7y ago
  Speaking as someone who writes code for authentication systems, it's not marketing hype. These physical U2F authenticators are more secure by design than the number based authenticator apps. Since the Yubikey (and friends) operates by generating a private key on the device itself, inaccessible to software, it means that the key is hard to clone. They'd have to steal it off your person. Combined with generating a unique key pair for every website and checking that the website is what it claims to be, this means that the key is resistant to replay attacks, which number based authenticator apps are vulnerable to. That isn't to say that it's immune to phishing, but it's much, much harder to phish someone who is using a Yubikey because an attacker would need to compromise someone's DNS configuration or SSL configuration to impersonate the website, at which point... why are they bothering with phishing?
- ben509 7y ago
  These are basically tiny hardware security modules. The premise of an HSM is that you have a hardened processor that contains the secrets and performs asymmetric crypto operations on request. Ideally, the device is designed such that the secrets never leave a crypto boundary. The big expensive ones will offer facilities to transfer keys, but only over an authenticated, encrypted connection to another device certified by the manufacturer[1]. Yubico has some FIPS certified devices[2], which means that they've presented a design that shows the device has mechanisms to prevent secrets from being extracted, and they're only using algorithms known by NIST not to leak secrets. > Also pardon me if I confused two-factor as the Google Authenticator app. Multi-factor authentication is about managing risk, and discussions about risk are naturally fuzzy and vague. I'll try a concrete analogy; consider firearms safety. Some typical rules[3]: 1. keep the weapon pointed down range at all times, 2. keep your finger out of the trigger well, 3. treat the weapon as loaded at all times. Each rule is a factor, and to accidentally hurt someone you have to violate all the rules at once. Multiple factors work best if they are orthogonal, that is, when a given action results in only breaching a single factor. That's why factors tend to be phrased as "something you know," "something you are," "something you have". The authenticator app and a Yubikey are doing the exact same thing: they're establishing the "something you have" factor. Since the two factors work when an attacker must both obtain the device and get your password, if your phone has both passwords and authenticator apps, the additional factors aren't minimizing that risk. [1]: The automatic vendor lock-in makes it a great business model... [2]: https://www.yubico.com/business/product/yubikey-fips https://www.yubico.com/business/product/yubikey-fips [3]: There are many more, but take a class on it rather than depend on the Internet.
moduspwnens14 7y ago
Does it do U2F on an iOS device?
- fheld 7y ago
  Partly, does't support new iPad pro and only in Brave browser > At launch, it’ll support these well-known password managers and single sign-on tools: 1Password, Bitwarden, Dashlane, Idaptive, LastPass, and Okta. And when using the Brave browser for iOS, the YubiKey 5Ci can be used as an easier way to log into Twitter, GitHub, 1Password’s web app, and a couple other services. see https://www.theverge.com/2019/8/20/20813129/ https://www.theverge.com/2019/8/20/20813129/
sakisv 7y ago
I think I'd preferred if they offered a USB-C and USB-A combo.
- ch 7y ago
  Something like this would suffice, if it was simple to keep along side the key: https://tripplite.com/usb-c-female-to-usb-a-male-adapter~U329000 https://tripplite.com/usb-c-female-to-usb-a-male-adapter~U32...
  - Scipio_Afri 7y ago
    I was looking into something like this, and while this probably works fine these aren't allowed under the USB spec, so you're hoping whoever designed these did it right and its not going to misbehave with some devices.
  - ericpauley 7y ago
    I use USB-C devices almost exclusively and opted the other way around, carrying a USB-A variant with a C-A adapter. A few reasons: * The A variant yubikey is crush resistant and mechanically simple for a longer life. * The adapter acts as a form of connector saver for my yubikey, since I usually keep it physically attached to the yubikey itself. With this approach both wear-prone sides (C male and A female) are on the adapter, which costs as little as 1/50th the price of the yubikey.
  - lxgr 7y ago
    This is non-compliant to the USB specifications and potentially dangerous (as in, it could fry your hardware). You might know what you are doing, but are you sure that's true for everybody who might find and use it in the future? Please don't buy/produce these things.
- throw0101a 7y ago
  I wonder if they'll release an NFC/USB-C unit as well. Or just go 'full compat' and do NFC/USB-A/C. I could see something like that being handy for IT folks.
jpalomaki 7y ago
Product page: https://www.yubico.com/products/yubikey-for-mobile/ https://www.yubico.com/products/yubikey-for-mobile/
specto 7y ago
Check out solokeys, though they're doing a hardware revision for the usb-c since it was flimsy and some NFC changes due to power draw
- hoytech 7y ago
  Solokeys are great. They also have a crowdsupply for a smaller form factor version (USB-A only for now): https://www.crowdsupply.com/solokeys/somu https://www.crowdsupply.com/solokeys/somu
bitxbit 7y ago
Just out of curiosity, is Apple migrating away from Lightning toward USB-C? $70 for one key is a bit steep especially if Apple eventually shelves Lightning on iPhones.
- Wowfunhappy 7y ago
  Regardless of what Apple plans to do (which really isn't an answerable question), I'd think what really matters is, what port does your phone have? If the choice is between a new $1,000 phone and this security key, $70 isn't that much. If you're already planning to buy a new iPhone in September, you should probably wait to buy any accessories. (And in truth, my gut is that Apple will stick with lightning on iPhones for some time.)
- ssully 7y ago
  So far it sounds like the next iPhone will still use lightning, so you should be safe using this Yubikey for a few years at least.
  - smacktoward 7y ago
    It would be deeply frustrating if Yubico were to spend years coming up with a 2FA product that works with iDevices, and then a few months later Apple were to throw out the interface that product depends on and thus instantly make it completely obsolete. (One would hope that Yubico and Apple have been in touch with each other at least the minimal amount that would be required to avoid such a fiasco. But given Apple's penchant for secrecy, who knows?)
    - deleted 7y ago
      [deleted]
    - vinay427 7y ago
      Current iPhones will at least be commonly in circulation for a few years, so it wouldn't be a complete waste.
    - ben509 7y ago
archi42 7y ago
That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would already have upgrade the daily driver to a NFC variant (so I could use it with my phone). So, to any webdevs on HN reading this: Take that shit serious and implement 2FA ;-) //edit: GitHub is just a single example; and it's possible to opt-out of SMS, if a authenticator app is used instead. That's what I mean by second class citizen: Security Key(s) + X is possible, but while X alone can be configured, Security Key(s) alone is(/are) not allowed.
- cj 7y ago
  Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of 2-FA. If you have a security key on your account, you must also have regular app-based 2-FA enabled as a fall back. What's the point of using security keys with services that require regular SMS or app-based 2-FA as a fallback? Edit: G Suite is one of the few services that got it right. G Suite has an optional security control that when enabled, forces authentication using security keys (explicitly forbidding alternate 2-fa methods).
  - somepig 7y ago
    regular "app based" is just OATH-TOTP in most cases. This uses a shared secret and the time to generate one time codes. The Yubikey explicitly supports TOTP, and will happily store your secret on the key. You can then use Yubioath to pull codes from the Yubikey as needed. I'm a huge fan of the ability to use either U2F or TOTP with the same hardware token.
    - 7y ago
kossae 7y ago
I thought Yubikey NEO supported NFC on iPhones. I remember reading there was some flaky support for a while, then a new SDK was released for iOS 11. Is there any advantage to using the pluggable Lightning Yubikey over the NEO? Perhaps better app support?
- samgranieri 7y ago
  If there's a way for 1password to work over NFC on iOS, i'd be happy. Still, I bought a lightning/usb-c key this morning.
- munchbunny 7y ago
  NFC support is spotty at the moment. The problem is that it's somewhat simpler to integrate FIDO/U2F via browser using the WebAuthn API than it is to implement a non-native FIDO SDK into your native app in a secure fashion. Once mobile browsers and iOS/Android web UI widgets get support for BLE and NFC WebAuthn, things should improve somewhat. FIDO (WebAuthn) via browser abstracts some nuances from you such as "how do you know you can trust the server you're talking to?" and "how do you deal with the difference between FIDO and FIDO2 authenticators?" alongside other details that the native SDK's don't abstract away from you. (For background: part of my day job is implementing authentication systems.)
- Fnoord 7y ago
  The NEO is a Yubikey v3. It supports NFC. v3 is the last FOSS one, but it does not support FIDO2. If you want a YubiKey with NFC which supports FIDO2, you need a YubiKey 5 (NFC version). Or a Solo with NFC (the Solo support FIDO2 and is FOSS). I happen to have one of the InCharge chargers as keychain [1] and what is interesting is that it is 3 chargers in one: one's always USB-A, other one is either USB-C or microUSB/lightning. So they combine microUSB with lightning on the same connector. I wonder why YubiCo did not go with a similar design. [1] https://www.indiegogo.com/projects/incharge-universal-one-cable-to-rule-them-all https://www.indiegogo.com/projects/incharge-universal-one-ca...
  - timothy-quinn 7y ago
    In my experience too with testing the NEO, they're just not as reliable to work with compared to the later models (both over NFC and USB). I believe the NEO was the first to bring in new features for the Yubikey, and the kinks weren't all ironed out yet. If you have a NEO still, I'd recommend at least upgrading to a 4 if you can.
stratosgear 7y ago
I would much rather back SOMU. https://www.crowdsupply.com/solokeys/somu#products-top https://www.crowdsupply.com/solokeys/somu#products-top
- falcolas 7y ago
  Which supports neither Lightning nor USB-C (not to mention that isn't funded yet).
haunter 7y ago
I tried the quiz to get a recommendation but it finishes in an endless loop > learn more > quiz starts again https://www.yubico.com/quiz/ https://www.yubico.com/quiz/ Also can anyone explain the multiple models too me? https://www.yubico.com/products/yubikey-hardware/ https://www.yubico.com/products/yubikey-hardware/ Say I want an USB-A key, I can choose from three and they all have different prices. The Security Keys are less secure than a FIPS or a 5? Maybe I'm just too end user but the multiple choices to me are the exact opposite of the easy to use principle. The whole product page is just confusing.
- pja 7y ago
  It’s not entirely obvious from the description, but the main difference is (I believe) that the cheap keys can only do FIDO 2-factor authentication whereas the expensive ones have secure storage so you do things like putting your pgp private keys on them. If all you want is true 2-factor authentication for Gmail / Facebook / Github etc then the cheap keys are exactly what you need.
- munchbunny 7y ago
  Short version: the FIPS is for enterprise. The Security Key is for consumers. The 5 series is for enterprise or power users. This might be more useful for you: https://www.yubico.com/products/yubikey-hardware/compare-products-series/ https://www.yubico.com/products/yubikey-hardware/compare-pro... You want the Yubikey FIPS if you're using it in a context where FIPS compliance matters, such as US government. If not (such as for personal use), then don't bother. The Security Key series is the budget minimal "works as a FIDO authenticator". It lacks the bells and whistles that come with the 5 series. AFAIK it is not "less secure," it just lacks bells and whistles. The 5 series works as a FIDO authenticator, but it also includes PIV capabilities (smartcards, PGP, etc.), which allow you to do stuff like this: https://developers.yubico.com/PGP/SSH_authentication/.* https://developers.yubico.com/PGP/SSH_authentication/.* The PIV capabilities matter more in the context of enterprise/government applications where smartcards have been in common use as a 2nd factor for many years, which makes having an all-in-one smartcard+FIDO device very convenient. * Caveat: I recommend against using your Yubikey for SSH private/public key authentication unless your SSH setup also requires a password. Single physical factor is worse than having a password protected key pair in your ~/.ssh folder.
throw0101a 7y ago
Handy table comparing their 5-series options: * https://www.yubico.com/products/yubikey-hardware/compare-yubikey-5-series/ https://www.yubico.com/products/yubikey-hardware/compare-yub... Seems the main questions to ask yourself are: * is NFC desired? * do you need/want USB-A or USB-C? This product adds a Lightning option.
- sebazzz 7y ago
  Is there no lightning to USB A adapter? Seems a bit wasteful to buy another key for a currently very limited ability in iOS.
  - ganoushoreilly 7y ago
    While limited today, there are a bunch of applications in beta testing that leverage the key. I personally have a small keychain usb-c to A adapter that I use with my Yubikey Neo. I guess all in they decided a Lightning and USB A option wasn't as smart given most mobile devices are Lightning or USBC moving forward.
    - throw0101a 7y ago
      The smartphone choices are Android and iOS, and those use USB-C and Lightning (respectively). I think they can actually reduce their offerings to two: * USB-C and USB-A * USB-C and Lightning NFC on both variants.
  - lxgr 7y ago
    There is, but the number of USB classes supported by iOS is limited. I think implementing new ones is not possible for applications without licensing MFi (which is incurring fees per unit sold, as far as I understand). The way they are doing it, Yubico doesn't need to pay/pass through that fee on each key sold, but only on the ones actually likely to be used with iOS devices.
pizzazzaro 7y ago
This uses libp11 backend. On Linux/BSD, that uses OpenSSL as its own backend. But you can compile libp11 against LibreSSL for extra. . . better-than-tinfoil.
dzhiurgis 7y ago
Is there any security cards that just use NFC (with physical button, obviously)? I think government issued cards are good contender for this. Perhaps it could even replicate certificate authority chain principles - certain cards could sign other cards and then can be invalidated if compromised. My local id card is absolutely pathetic. I have no idea where to get a reader (although they are generic) and worst part is requirement to run Java applet in your browser - something that has been dead for over 10 years...
- mschuster91 7y ago
  > I think government issued cards are good contender for this. For this, devices would have to support real NFC in the first place. iPhones/iPads don't allow app usage of NFC, and the flagship Samsung tablets don't ship with it at all.
  - vinay427 7y ago
    Most modern Android phones, or at least the Samsung ones and probably Google ones I have used, allow for virtually full read/write NFC access as far as I can tell.
    - mschuster91 7y ago
      That would require NFC support in the first place. Just imagine: all flagship tablet models of Samsung do not ship with NFC. What kind of nonsense is that?!
  - 0xCMP 7y ago
    In iOS 13 they opened up the APIs. Not clear what that's going to mean yet for Yubikey and etc.
  - dzhiurgis 7y ago
    What’s a “real NFC”? I know they already let certain apps to read pom’s passports. Just a matter setting a standard?
kop316 7y ago
I actually had the chance to try out a prototype at Blackhat. I was actually able to have the USB-C portion recognized on my Android Phone (via the USB port), and it was recognized in Firefox and lsusb (though for some reason I was unable to register it, and I has the u2f enabled in about:config). I am tempted to buy it to see if I could get it to work on my phone, I would much rather have the USB-C work on my phone than an NFC.
- ecesena 7y ago
  Any usb-c key should work on Android. Firefox has been recently updated to support webauthn, so you no longer have to turn u2f on. Note that some sites, like Google, only allow you to register the key on Chrome, but then you can use it on Firefox too.
  - kop316 7y ago
    Heh. neat, thank you! I will have to try it out then. I tried to register it on my Nextcloud instance, so I was surprised it didn't work.
anilakar 7y ago
There's still one huge disadvantage with hardware-based FIDO U2F tokens: There's no good way to migrate from one to another. I've got three(!) Yubikeys of different generations on my keyring because I'm not sure whether I have enrolled the two newer ones to all the services I'm using.
- kelnos 7y ago
  It's too late for you, but: create Google doc. Add service to list when enrolling. When you get a new key, consult list.
- timothy-quinn 7y ago
  This is something I'm trying to simplify with my product. The foundational security features of U2F (you can't interrogate the device to find out what other services are set up) make it basically impossible to migrate them to new devices, but all the other capabilities of the Yubikeys can be moved across. This is really why U2F falls over in the Enterprise, at least from what I've seen. Customers want centralised management, but the U2F protocol just can't support that.
- coughlanio 7y ago
  I use 1Password as my password manager, and add a tag to each login where I have a specific hardware key registered.
- ahelwer 7y ago
  The absolute dream is to have a single nonprofit OAuth identity provider against which people can prove their identities with FIDO U2F, then use the issued tokens to auth with services of their choosing. Building this network is incredibly hard, though (what website would accept an identity provider without any users, and what users would use an identity provider not accepted by any websites?) so the most popular implementations are hosted by Google or Facebook - but there you have all the obvious privacy issues.
bfirsh 7y ago
The Yubikey website is vague, but it seems like the lightning end only works with a few apps (1Password, Brave, etc). What do I do if I want to sign in to anything else that needs 2FA? Do I still need a TOTP app?
- timothy-quinn 7y ago
  From what I've heard from Yubico the next version of iOS is going to make it far easier to communicate with the device. Integrations will probably still need to be added by the app developers though to take full advantage.
  - jonlucc 7y ago
    "Next version" meaning iOS 13? Or the version after (presumably iOS 14)?
  - bfirsh 7y ago
    Do you know whether that includes websites in Safari? If I can’t use 2FA for that, I don’t see how I can use a Yubikey.
    - apple4ever 7y ago
      That's my biggest problem. Until I can use a key in Safari and on iOS, they are useless for me.
    - allset_ 7y ago
      Apple appears to be working to add WebAuthn support to Safari. See https://appleinsider.com/articles/18/12/05/apple-testing-usb-security-key-support-for-safari https://appleinsider.com/articles/18/12/05/apple-testing-usb...
    - timothy-quinn 7y ago
      It's hard to say until we see it in action. I'm optimistic, but with Apple's track record of hobbling integrations in annoying ways I'm still a little hesitant. I really do want them to work fully though so I can extend my product to mobile too. I know a lot of people now that have gotten rid of their computers and just use their phones for everything.
deanclatworthy 7y ago
Strong advise anyone considering putting one of these on their keychains to consider otherwise. The actual connector of my usb-c version has warped in my pocket over time and it’s now not recognised.
- rullgrus 7y ago
  I wonder how hard it is to create a really sturdy USB-C plug. The connector on all of the USB-C cables I have does seem a little flimsy. I have an YubiKey 5 NFC on the keychan and it has handled the abuse over the years just fine.
- jwr 7y ago
  The USB-A version is great. I've been using it for more than a year now and it has taken all kinds of abuse. I'm considering keeping it and using a small USB-C -> USB-A dongle. I have to live a dongle life anyway (because of the stupid Apple decision to go all-in on USB-C, with users as hostages), so it doesn't matter that much.
- PStamatiou 7y ago
  How long have you had it? Have had a USB-C yubikey in my pocket for almost 2 years now with no issues.
- sdflhasjd 7y ago
  This was my main concern when I bought my USB-C version as well. But what actually happened was the plastic casing crumbled (!?), eventually enough of the casing came off that the USB-C connector was only held on by some solder pads, which eventually failed. For a pretty critical device, the USB-C version is rubbish.
Slippery_John 7y ago
To those that have yubikeys: are they actually durable enough to keep on a key chain?
- filleokus 7y ago
  The USB-A versions are practically speaking indestructible. I've had them for over 10 years now without any problems. The USB-C versions look much more fragile though...
  - lxgr 7y ago
    They actually feel very robust. I've been carrying mine around on a keychain in my pocket for a year now and it works flawlessly.
- miguelmota 7y ago
  I've had a YubiKey5 which uses the standard USB for a while and never had issues. They’re also cheap enough to replace easily but I doubt it'll break by it being in your pocket with other keys unless you severely bend it or something.
- tomjen3 7y ago
  I had no issues with the one one my daily keychain, which has been there for 2ish years now.
miguelmota 7y ago
This is awesome, been waiting for this for quite a while. The Google Titan bluetooth support never worked on my phone so it’s cool that I can plug it in directly now with this YubiKey.
ryanmarsh 7y ago
Serious question: If Safari doesn't support U2F/FIDO what good will a Lightning based Yubi key do me? To be clear, I'm not knocking the use of these keys. I have Yubi Nano on my laptop and love it.
- brisance 7y ago
  You can download Chrome, Firefox and Opera from the Apple App Store.
exabrial 7y ago
On an iPhone, will this work when you try to login to your google account in system prefs? It's been my experience with Bluetooth Fido keys that this does not work.
OJFord 7y ago
Does the 5C/Nano work with Android phones with USB-C? I thought I was waiting for a 5C NFC, but maybe I've been overlooking the obvious. For some reason it never occured to me that it might work plugged directly into my phone if only it had the right shape. (I have a 5 Nano, which was great until I got a USB-C Macbook and broke several keychain adapters before giving in and buying one of those hubs that stick on one side converting the 2x USB-C to the same + USB-A, HDMI, and SD.)
- sgarman 7y ago
  I have used the 5C with my Samsung Galaxy note w/o any issues, just plug it in the bottom.
- hatfortguy 7y ago
  This is what I do. The USB-C one's work on Android just fine but it's a little less intuitive; the YubiAuth app still complains if NFC is disabled and you might have to turn on OTG for the key to be recognised (which auto turns off on some phones after 10 mins).
s3cur3 7y ago
I was an early, enthusiastic adopter of Yubikeys at my work. Above and beyond the other issues people have mentioned, though, the one that kills the product for me is the frankly stupid OS integration. The key behaves like “just” a special kind of keyboard which types a long string of gibberish and then hits enter any time you touch the trigger. I can’t tell you how many times I have accidentally bumped the thing and thereby entered my secret key in: - text editors - the URL bar of my browser (!) - Slack chats (!!) The solution seems obvious to me: make a new type of input field at the browser and OS level which accepts U2F input, then reject that input in any text field that doesn’t opt in. This one issue has made the key way more of a liability than a simple authenticator app for me.
- sigwinch28 7y ago
  What are you talking about? The default configuration definitely does not type your secret key, but a one time password. The entire point of the default configuration is that the secret key is stored only on the device and never leaves it.
  - sigwinch28 7y ago
    I should clarify: the secret key should never leave the device after configuration is completed.
- raamdev 7y ago
  The macOS YubiSwitch app solves that problem nicely. https://support.yubico.com/support/solutions/articles/15000006440-accidentally-triggering-otp-codes-with-your-nano-yubikey https://support.yubico.com/support/solutions/articles/150000...
- LIV2 7y ago
  If you’re not using both slots you can move the credential to slot 2 so that it requires a long press before it activates
- PStamatiou 7y ago
  You can disable this OTP mode of the YubiKey with either the "Yubikey Manager" or more advanced "Yubikey Personalization Tool" software. It's unrelated to FIDO U2F. It's the first thing I do with any new key as I find it similarly annoying.. I accidentally tapped it once while working in Adobe Lightroom and it triggered a sequence of actions that went on for 30 seconds that I couldn't undo..

263 points by jeromegv 7y ago

> Security keys offer almost unbeatable security and can protect against a variety of threats, including nation-state attackers. Alright, I'm not a security expert, but I'm not completely illiterate to basic computer security. Anyone care to chime in how this is much more secure than a two-factor app? Sure there's the obvious, nobody can just copy the two-factor app off my phone with all the codes and have the same codes (I've upgraded phones and taken my codes with me before...) but whose to stop someone from cloning a Yubico key? Again I'm not an expert, but I do want to know if this is purely marketing hype or if there's some security to Yubikey and friends that I'm not aware of. Also pardon me if I confused two-factor as the Google Authenticator app. Too many "factor" terms get a bit confusing after a while.

Znafon 7y ago
You can get phised to enter your two factor in a random web forms but it is not possible to do this with U2F (https://en.wikipedia.org/wiki/Universal_2nd_Factor https://en.wikipedia.org/wiki/Universal_2nd_Factor). For example, Google reported that deploying U2F blocked all phising attempts of their employees : https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu....
knd775 7y ago
> cloning a Yubico key This should be impossible.
- aequitas 7y ago
  It might not be impossible, but surely non-trivial. Add to that that it has to be done in a undetectable way and the key owner needs to be parted for the key in the time it takes to make the clone.
  - Freak_NL 7y ago
    You'd probably destroy the key's shell in the process of getting to the microchip (you can't get to the private key via the USB connector by design, so decapping is probably the only way to do it), so you would have to have a clone ready that looks exactly like the key you've just disfigured to get to the secret key.
    - GoMonad 7y ago
      Moreover, if a physically undetected clone is managed, it will be detected soon through the spec. The WebAuthn spec includes monitoring an always increasing counter for each key/site pair. One of the clones will start to fail. So really there's no point in cloning. Straight up theft is the bigger concern.
tialaramex 7y ago
The two factor app (say, TOTP) involves a _secret_ used to generate a changing value and so bad guys can do either of two things: 1. They can steal the secret, from you or from the other party (the service you're authenticating to) 2. They can relay your answer, without knowing the secret and since the answer is genuine their relayed answer will be accepted. Example you type the One Time Code into https://fakebank.example/ https://fakebank.example/ thinking it is your bank, then the bad guys simply paste that same code into https://realbank.example https://realbank.example the actual site of your bank and it works - they get into your account. FIDO Security Keys don't use a shared secret, instead they use public key crypto. Your Security Key proves it is still the same key as it was when you registered, but the remote site doesn't have any secrets so they could even _publish_ the data they store to authenticate you and that wouldn't matter to the system's security. And it relies on the web browser to tie the FQDN into the data signed. If you press the button on the Security Key on https://fakebank.example/ https://fakebank.example/ the results are only proof for fakebank, operated by the bad guys, if they forward it to https://realbank.example/ https://realbank.example/ it won't work because the name is wrong and it doesn't match. Does that help? There are a bunch of other cool things about Security Keys, but those are the main ways it's simply better for security than a conventional TOTP-style second factor.
mightybyte 7y ago
> whose to stop someone from cloning a Yubico key? That is precisely what these devices are designed to stop. The device has a private key stored in hardware in a way that it cannot be retrieved by software. When you use one of these devices you dramatically decrease your number of attack vectors because now the attack has to happen physically. Someone has to actually steal your physical key. And because this is your "second factor", if that happens they still also have to have your password. Two-factor apps get closer to this, but they usually can be copied. For instance, 1Password can be set up to mimic Google Authenticator. > I do want to know if this is purely marketing hype This is most definitely NOT marketing hype. It is the current security best practice.
- grepthisab 7y ago
  I didn't know about 1Pass, I've been a paying member for a while. I'll try that out! But to put a finer point on your actual statement, I usually screenshot the MFA setup in case my phone gets lost, so I can easily re-set it up.
  - notlukesky 7y ago
    With SAASPASS Authenticator you can set up recovery in case you lose your or change your phone.
    - eropple 7y ago
      For those who aren't aware, the author of the post works for them. Maybe a founder; it's a little hard to tell. I've run across him doing exactly this in the past. Bad form, and (having looked at it in the past) the product he's flogging is amateurish.
- giancarlostoro 7y ago
  Impresive, have they had external security firms try to steal the private key? Thats my final thought. I guess it makes sense. By the time an adversary gets your key you would of noticed and have locked that key from your account.
tptacek 7y ago
Simple: security keys combat phishing, two-factor apps do not. A security key doesn't just authenticate you to a site: it also authenticates the site to you.
- notlukesky 7y ago
  Security keys are two factor as well. In fact there are multiple different types of 2FA with different security levels. SMS 2FA is one of the weakest. Push Login is moderate. Scanning encrypted barcodes is highest and also phishing proof like FIDO keys.
  - tialaramex 7y ago
    > Scanning encrypted barcodes is highest and also phishing proof like FIDO keys. I have never seen a solution like this, but I can't see how it would avoid simple relay phish, it seems as though bad guys can just get themselves a legitimate encrypted barcode and have their victim scan it. Maybe you haven't explained this solution properly, do you have a link?
- lxgr 7y ago
  I think I get what you are trying to express, but rather than "it authenticates the site to you", I think that should be phrased "it prevents you from authenticating at a site pretending to be some other site. evil.com can still claim to be mysite.com and trick users into using their security key there, no? It would presumably have to trick the user into "registering again" since there is no valid key handle for FIDO2 (not sure about classic U2F), but I doubt that users would notice the difference in flows. The real win is that this spoof would still not give evil.com a credential scoped to mysite.com, but a user would be none the wiser that they are on a different site than they expect (which can still be problematic depending on the nature of the site).
  - juliusmusseau 7y ago
    Suppose the key allows mysite.com to let you see your emails, send more emails, and send money to people, etc. Basically mysite.com let's you see and do interesting things after you've authed. Even if evil.com gets you to register and present your key, they cannot forward it to mysite.com. Even if they go to all the trouble to completely mitm you and the site looks identical to mysite.com, they cannot get the emails or get it to send money. This is because evil.com cannot pretend to be you when they interact with mysite.com no matter what you've given them. It's going to be hard to trick me into thinking I've logged into my gmail if none of my emails are there! Unless they somehow convince you to put your yubikey in the mail and physically send it to them...
rurban 7y ago
It isn't. SW can be updated and is usually open-source and mostly secure. HW not so. At least two HW backdoors have been found in chips such as this one in earlier versions, the first using an improper RSALib RSA variant (developed by NSA or Mossad). The source for the second, SCADA, is unknown. So any nation state wanting the most people to use it, will advertise it as such. "unbeatable security and can protect against a variety of threats, including nation-state attackers." This happened with the Infineon backdoor, the SCADA backdoor, the earlier Crypto AG backdoors. https://acmccs.github.io/papers/p1631-nemecA.pdf https://acmccs.github.io/papers/p1631-nemecA.pdf
- lxgr 7y ago
  The firmware not being updateable is a desired property of most security keys, actually. At least Yubico considers the risk of compromises through firmware updates as too high: https://support.yubico.com/support/solutions/articles/15000006434-upgrading-yubikey-firmware https://support.yubico.com/support/solutions/articles/150000... Obviously they are biased – they are in the business of selling hardware, not software, but their reasoning still makes sense to me. It's arguable whether "destructive updates" that invalidate all existing registrations should be allowed, but that could have its own problems in terms of availability if not clearly communicated. On a related note, I wonder if there is actually a more secure way of preventing illegitimate firmware updates in JavaCard/GlobalPlatform than randomizing the card manager keys, which is what Yubico does for the NEO: https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
munchbunny 7y ago
Speaking as someone who writes code for authentication systems, it's not marketing hype. These physical U2F authenticators are more secure by design than the number based authenticator apps. Since the Yubikey (and friends) operates by generating a private key on the device itself, inaccessible to software, it means that the key is hard to clone. They'd have to steal it off your person. Combined with generating a unique key pair for every website and checking that the website is what it claims to be, this means that the key is resistant to replay attacks, which number based authenticator apps are vulnerable to. That isn't to say that it's immune to phishing, but it's much, much harder to phish someone who is using a Yubikey because an attacker would need to compromise someone's DNS configuration or SSL configuration to impersonate the website, at which point... why are they bothering with phishing?
ben509 7y ago
These are basically tiny hardware security modules. The premise of an HSM is that you have a hardened processor that contains the secrets and performs asymmetric crypto operations on request. Ideally, the device is designed such that the secrets never leave a crypto boundary. The big expensive ones will offer facilities to transfer keys, but only over an authenticated, encrypted connection to another device certified by the manufacturer[1]. Yubico has some FIPS certified devices[2], which means that they've presented a design that shows the device has mechanisms to prevent secrets from being extracted, and they're only using algorithms known by NIST not to leak secrets. > Also pardon me if I confused two-factor as the Google Authenticator app. Multi-factor authentication is about managing risk, and discussions about risk are naturally fuzzy and vague. I'll try a concrete analogy; consider firearms safety. Some typical rules[3]: 1. keep the weapon pointed down range at all times, 2. keep your finger out of the trigger well, 3. treat the weapon as loaded at all times. Each rule is a factor, and to accidentally hurt someone you have to violate all the rules at once. Multiple factors work best if they are orthogonal, that is, when a given action results in only breaching a single factor. That's why factors tend to be phrased as "something you know," "something you are," "something you have". The authenticator app and a Yubikey are doing the exact same thing: they're establishing the "something you have" factor. Since the two factors work when an attacker must both obtain the device and get your password, if your phone has both passwords and authenticator apps, the additional factors aren't minimizing that risk. [1]: The automatic vendor lock-in makes it a great business model... [2]: https://www.yubico.com/business/product/yubikey-fips https://www.yubico.com/business/product/yubikey-fips [3]: There are many more, but take a class on it rather than depend on the Internet.

moduspwnens14 7y ago

Does it do U2F on an iOS device?

fheld 7y ago
Partly, does't support new iPad pro and only in Brave browser > At launch, it’ll support these well-known password managers and single sign-on tools: 1Password, Bitwarden, Dashlane, Idaptive, LastPass, and Okta. And when using the Brave browser for iOS, the YubiKey 5Ci can be used as an easier way to log into Twitter, GitHub, 1Password’s web app, and a couple other services. see https://www.theverge.com/2019/8/20/20813129/ https://www.theverge.com/2019/8/20/20813129/

sakisv 7y ago

I think I'd preferred if they offered a USB-C and USB-A combo.

ch 7y ago
Something like this would suffice, if it was simple to keep along side the key: https://tripplite.com/usb-c-female-to-usb-a-male-adapter~U329000 https://tripplite.com/usb-c-female-to-usb-a-male-adapter~U32...
- Scipio_Afri 7y ago
  I was looking into something like this, and while this probably works fine these aren't allowed under the USB spec, so you're hoping whoever designed these did it right and its not going to misbehave with some devices.
- ericpauley 7y ago
  I use USB-C devices almost exclusively and opted the other way around, carrying a USB-A variant with a C-A adapter. A few reasons: * The A variant yubikey is crush resistant and mechanically simple for a longer life. * The adapter acts as a form of connector saver for my yubikey, since I usually keep it physically attached to the yubikey itself. With this approach both wear-prone sides (C male and A female) are on the adapter, which costs as little as 1/50th the price of the yubikey.
- lxgr 7y ago
  This is non-compliant to the USB specifications and potentially dangerous (as in, it could fry your hardware). You might know what you are doing, but are you sure that's true for everybody who might find and use it in the future? Please don't buy/produce these things.
throw0101a 7y ago
I wonder if they'll release an NFC/USB-C unit as well. Or just go 'full compat' and do NFC/USB-A/C. I could see something like that being handy for IT folks.

jpalomaki 7y ago

Product page: https://www.yubico.com/products/yubikey-for-mobile/ https://www.yubico.com/products/yubikey-for-mobile/

specto 7y ago

Check out solokeys, though they're doing a hardware revision for the usb-c since it was flimsy and some NFC changes due to power draw

hoytech 7y ago
Solokeys are great. They also have a crowdsupply for a smaller form factor version (USB-A only for now): https://www.crowdsupply.com/solokeys/somu https://www.crowdsupply.com/solokeys/somu

bitxbit 7y ago

Just out of curiosity, is Apple migrating away from Lightning toward USB-C? $70 for one key is a bit steep especially if Apple eventually shelves Lightning on iPhones.

Wowfunhappy 7y ago
Regardless of what Apple plans to do (which really isn't an answerable question), I'd think what really matters is, what port does your phone have? If the choice is between a new $1,000 phone and this security key, $70 isn't that much. If you're already planning to buy a new iPhone in September, you should probably wait to buy any accessories. (And in truth, my gut is that Apple will stick with lightning on iPhones for some time.)
ssully 7y ago
So far it sounds like the next iPhone will still use lightning, so you should be safe using this Yubikey for a few years at least.
- smacktoward 7y ago
  It would be deeply frustrating if Yubico were to spend years coming up with a 2FA product that works with iDevices, and then a few months later Apple were to throw out the interface that product depends on and thus instantly make it completely obsolete. (One would hope that Yubico and Apple have been in touch with each other at least the minimal amount that would be required to avoid such a fiasco. But given Apple's penchant for secrecy, who knows?)
  - deleted 7y ago
    [deleted]
  - vinay427 7y ago
    Current iPhones will at least be commonly in circulation for a few years, so it wouldn't be a complete waste.
  - ben509 7y ago

archi42 7y ago

That sounds nice. But while using U2F/FIDO for a few years (with two HyperFIDOs, one for "daily" use attached to my key-chain, the other as a backup in a safe), I found the most common problem was that websites/services don't tread these keys as first class citizens. For example GitHub: I have my two keys setup there, but I can't opt-out of SMS authentication. If I knew I could use my keys at more services, I would already have upgrade the daily driver to a NFC variant (so I could use it with my phone). So, to any webdevs on HN reading this: Take that shit serious and implement 2FA ;-) //edit: GitHub is just a single example; and it's possible to opt-out of SMS, if a authenticator app is used instead. That's what I mean by second class citizen: Security Key(s) + X is possible, but while X alone can be configured, Security Key(s) alone is(/are) not allowed.

cj 7y ago
Last year I got the Google Titan security keys and connected it with all of my work + personal accounts that support it. The #1 weakness is the simple fact that many services don't allow you to disable alternate forms of 2fa. Github is an example, you can always trigger the fallback SMS 2fa code. Dashlane is another example (and arguably the most important). It's impossible to make your security key the only form of 2-FA. If you have a security key on your account, you must also have regular app-based 2-FA enabled as a fall back. What's the point of using security keys with services that require regular SMS or app-based 2-FA as a fallback? Edit: G Suite is one of the few services that got it right. G Suite has an optional security control that when enabled, forces authentication using security keys (explicitly forbidding alternate 2-fa methods).
- somepig 7y ago
  regular "app based" is just OATH-TOTP in most cases. This uses a shared secret and the time to generate one time codes. The Yubikey explicitly supports TOTP, and will happily store your secret on the key. You can then use Yubioath to pull codes from the Yubikey as needed. I'm a huge fan of the ability to use either U2F or TOTP with the same hardware token.
  - 7y ago

kossae 7y ago

I thought Yubikey NEO supported NFC on iPhones. I remember reading there was some flaky support for a while, then a new SDK was released for iOS 11. Is there any advantage to using the pluggable Lightning Yubikey over the NEO? Perhaps better app support?

samgranieri 7y ago
If there's a way for 1password to work over NFC on iOS, i'd be happy. Still, I bought a lightning/usb-c key this morning.
munchbunny 7y ago
NFC support is spotty at the moment. The problem is that it's somewhat simpler to integrate FIDO/U2F via browser using the WebAuthn API than it is to implement a non-native FIDO SDK into your native app in a secure fashion. Once mobile browsers and iOS/Android web UI widgets get support for BLE and NFC WebAuthn, things should improve somewhat. FIDO (WebAuthn) via browser abstracts some nuances from you such as "how do you know you can trust the server you're talking to?" and "how do you deal with the difference between FIDO and FIDO2 authenticators?" alongside other details that the native SDK's don't abstract away from you. (For background: part of my day job is implementing authentication systems.)
Fnoord 7y ago
The NEO is a Yubikey v3. It supports NFC. v3 is the last FOSS one, but it does not support FIDO2. If you want a YubiKey with NFC which supports FIDO2, you need a YubiKey 5 (NFC version). Or a Solo with NFC (the Solo support FIDO2 and is FOSS). I happen to have one of the InCharge chargers as keychain [1] and what is interesting is that it is 3 chargers in one: one's always USB-A, other one is either USB-C or microUSB/lightning. So they combine microUSB with lightning on the same connector. I wonder why YubiCo did not go with a similar design. [1] https://www.indiegogo.com/projects/incharge-universal-one-cable-to-rule-them-all https://www.indiegogo.com/projects/incharge-universal-one-ca...
- timothy-quinn 7y ago
  In my experience too with testing the NEO, they're just not as reliable to work with compared to the later models (both over NFC and USB). I believe the NEO was the first to bring in new features for the Yubikey, and the kinks weren't all ironed out yet. If you have a NEO still, I'd recommend at least upgrading to a 4 if you can.

stratosgear 7y ago

I would much rather back SOMU. https://www.crowdsupply.com/solokeys/somu#products-top https://www.crowdsupply.com/solokeys/somu#products-top

falcolas 7y ago
Which supports neither Lightning nor USB-C (not to mention that isn't funded yet).

haunter 7y ago

I tried the quiz to get a recommendation but it finishes in an endless loop > learn more > quiz starts again https://www.yubico.com/quiz/ https://www.yubico.com/quiz/ Also can anyone explain the multiple models too me? https://www.yubico.com/products/yubikey-hardware/ https://www.yubico.com/products/yubikey-hardware/ Say I want an USB-A key, I can choose from three and they all have different prices. The Security Keys are less secure than a FIPS or a 5? Maybe I'm just too end user but the multiple choices to me are the exact opposite of the easy to use principle. The whole product page is just confusing.

pja 7y ago
It’s not entirely obvious from the description, but the main difference is (I believe) that the cheap keys can only do FIDO 2-factor authentication whereas the expensive ones have secure storage so you do things like putting your pgp private keys on them. If all you want is true 2-factor authentication for Gmail / Facebook / Github etc then the cheap keys are exactly what you need.
munchbunny 7y ago
Short version: the FIPS is for enterprise. The Security Key is for consumers. The 5 series is for enterprise or power users. This might be more useful for you: https://www.yubico.com/products/yubikey-hardware/compare-products-series/ https://www.yubico.com/products/yubikey-hardware/compare-pro... You want the Yubikey FIPS if you're using it in a context where FIPS compliance matters, such as US government. If not (such as for personal use), then don't bother. The Security Key series is the budget minimal "works as a FIDO authenticator". It lacks the bells and whistles that come with the 5 series. AFAIK it is not "less secure," it just lacks bells and whistles. The 5 series works as a FIDO authenticator, but it also includes PIV capabilities (smartcards, PGP, etc.), which allow you to do stuff like this: https://developers.yubico.com/PGP/SSH_authentication/.* https://developers.yubico.com/PGP/SSH_authentication/.* The PIV capabilities matter more in the context of enterprise/government applications where smartcards have been in common use as a 2nd factor for many years, which makes having an all-in-one smartcard+FIDO device very convenient. * Caveat: I recommend against using your Yubikey for SSH private/public key authentication unless your SSH setup also requires a password. Single physical factor is worse than having a password protected key pair in your ~/.ssh folder.

throw0101a 7y ago

Handy table comparing their 5-series options: * https://www.yubico.com/products/yubikey-hardware/compare-yubikey-5-series/ https://www.yubico.com/products/yubikey-hardware/compare-yub... Seems the main questions to ask yourself are: * is NFC desired? * do you need/want USB-A or USB-C? This product adds a Lightning option.

sebazzz 7y ago
Is there no lightning to USB A adapter? Seems a bit wasteful to buy another key for a currently very limited ability in iOS.
- ganoushoreilly 7y ago
  While limited today, there are a bunch of applications in beta testing that leverage the key. I personally have a small keychain usb-c to A adapter that I use with my Yubikey Neo. I guess all in they decided a Lightning and USB A option wasn't as smart given most mobile devices are Lightning or USBC moving forward.
  - throw0101a 7y ago
    The smartphone choices are Android and iOS, and those use USB-C and Lightning (respectively). I think they can actually reduce their offerings to two: * USB-C and USB-A * USB-C and Lightning NFC on both variants.
- lxgr 7y ago
  There is, but the number of USB classes supported by iOS is limited. I think implementing new ones is not possible for applications without licensing MFi (which is incurring fees per unit sold, as far as I understand). The way they are doing it, Yubico doesn't need to pay/pass through that fee on each key sold, but only on the ones actually likely to be used with iOS devices.

pizzazzaro 7y ago

This uses libp11 backend. On Linux/BSD, that uses OpenSSL as its own backend. But you can compile libp11 against LibreSSL for extra. . . better-than-tinfoil.

dzhiurgis 7y ago

Is there any security cards that just use NFC (with physical button, obviously)? I think government issued cards are good contender for this. Perhaps it could even replicate certificate authority chain principles - certain cards could sign other cards and then can be invalidated if compromised. My local id card is absolutely pathetic. I have no idea where to get a reader (although they are generic) and worst part is requirement to run Java applet in your browser - something that has been dead for over 10 years...

mschuster91 7y ago
> I think government issued cards are good contender for this. For this, devices would have to support real NFC in the first place. iPhones/iPads don't allow app usage of NFC, and the flagship Samsung tablets don't ship with it at all.
- vinay427 7y ago
  Most modern Android phones, or at least the Samsung ones and probably Google ones I have used, allow for virtually full read/write NFC access as far as I can tell.
  - mschuster91 7y ago
    That would require NFC support in the first place. Just imagine: all flagship tablet models of Samsung do not ship with NFC. What kind of nonsense is that?!
- 0xCMP 7y ago
  In iOS 13 they opened up the APIs. Not clear what that's going to mean yet for Yubikey and etc.
- dzhiurgis 7y ago
  What’s a “real NFC”? I know they already let certain apps to read pom’s passports. Just a matter setting a standard?

kop316 7y ago

I actually had the chance to try out a prototype at Blackhat. I was actually able to have the USB-C portion recognized on my Android Phone (via the USB port), and it was recognized in Firefox and lsusb (though for some reason I was unable to register it, and I has the u2f enabled in about:config). I am tempted to buy it to see if I could get it to work on my phone, I would much rather have the USB-C work on my phone than an NFC.

ecesena 7y ago
Any usb-c key should work on Android. Firefox has been recently updated to support webauthn, so you no longer have to turn u2f on. Note that some sites, like Google, only allow you to register the key on Chrome, but then you can use it on Firefox too.
- kop316 7y ago
  Heh. neat, thank you! I will have to try it out then. I tried to register it on my Nextcloud instance, so I was surprised it didn't work.

anilakar 7y ago

There's still one huge disadvantage with hardware-based FIDO U2F tokens: There's no good way to migrate from one to another. I've got three(!) Yubikeys of different generations on my keyring because I'm not sure whether I have enrolled the two newer ones to all the services I'm using.

kelnos 7y ago
It's too late for you, but: create Google doc. Add service to list when enrolling. When you get a new key, consult list.
timothy-quinn 7y ago
This is something I'm trying to simplify with my product. The foundational security features of U2F (you can't interrogate the device to find out what other services are set up) make it basically impossible to migrate them to new devices, but all the other capabilities of the Yubikeys can be moved across. This is really why U2F falls over in the Enterprise, at least from what I've seen. Customers want centralised management, but the U2F protocol just can't support that.
coughlanio 7y ago
I use 1Password as my password manager, and add a tag to each login where I have a specific hardware key registered.
ahelwer 7y ago
The absolute dream is to have a single nonprofit OAuth identity provider against which people can prove their identities with FIDO U2F, then use the issued tokens to auth with services of their choosing. Building this network is incredibly hard, though (what website would accept an identity provider without any users, and what users would use an identity provider not accepted by any websites?) so the most popular implementations are hosted by Google or Facebook - but there you have all the obvious privacy issues.

bfirsh 7y ago

The Yubikey website is vague, but it seems like the lightning end only works with a few apps (1Password, Brave, etc). What do I do if I want to sign in to anything else that needs 2FA? Do I still need a TOTP app?

timothy-quinn 7y ago
From what I've heard from Yubico the next version of iOS is going to make it far easier to communicate with the device. Integrations will probably still need to be added by the app developers though to take full advantage.
- jonlucc 7y ago
  "Next version" meaning iOS 13? Or the version after (presumably iOS 14)?
- bfirsh 7y ago
  Do you know whether that includes websites in Safari? If I can’t use 2FA for that, I don’t see how I can use a Yubikey.
  - apple4ever 7y ago
    That's my biggest problem. Until I can use a key in Safari and on iOS, they are useless for me.
  - allset_ 7y ago
    Apple appears to be working to add WebAuthn support to Safari. See https://appleinsider.com/articles/18/12/05/apple-testing-usb-security-key-support-for-safari https://appleinsider.com/articles/18/12/05/apple-testing-usb...
  - timothy-quinn 7y ago
    It's hard to say until we see it in action. I'm optimistic, but with Apple's track record of hobbling integrations in annoying ways I'm still a little hesitant. I really do want them to work fully though so I can extend my product to mobile too. I know a lot of people now that have gotten rid of their computers and just use their phones for everything.

deanclatworthy 7y ago

Strong advise anyone considering putting one of these on their keychains to consider otherwise. The actual connector of my usb-c version has warped in my pocket over time and it’s now not recognised.

rullgrus 7y ago
I wonder how hard it is to create a really sturdy USB-C plug. The connector on all of the USB-C cables I have does seem a little flimsy. I have an YubiKey 5 NFC on the keychan and it has handled the abuse over the years just fine.
jwr 7y ago
The USB-A version is great. I've been using it for more than a year now and it has taken all kinds of abuse. I'm considering keeping it and using a small USB-C -> USB-A dongle. I have to live a dongle life anyway (because of the stupid Apple decision to go all-in on USB-C, with users as hostages), so it doesn't matter that much.
PStamatiou 7y ago
How long have you had it? Have had a USB-C yubikey in my pocket for almost 2 years now with no issues.
sdflhasjd 7y ago
This was my main concern when I bought my USB-C version as well. But what actually happened was the plastic casing crumbled (!?), eventually enough of the casing came off that the USB-C connector was only held on by some solder pads, which eventually failed. For a pretty critical device, the USB-C version is rubbish.

Slippery_John 7y ago

To those that have yubikeys: are they actually durable enough to keep on a key chain?

filleokus 7y ago
The USB-A versions are practically speaking indestructible. I've had them for over 10 years now without any problems. The USB-C versions look much more fragile though...
- lxgr 7y ago
  They actually feel very robust. I've been carrying mine around on a keychain in my pocket for a year now and it works flawlessly.
miguelmota 7y ago
I've had a YubiKey5 which uses the standard USB for a while and never had issues. They’re also cheap enough to replace easily but I doubt it'll break by it being in your pocket with other keys unless you severely bend it or something.
tomjen3 7y ago
I had no issues with the one one my daily keychain, which has been there for 2ish years now.

miguelmota 7y ago

This is awesome, been waiting for this for quite a while. The Google Titan bluetooth support never worked on my phone so it’s cool that I can plug it in directly now with this YubiKey.

ryanmarsh 7y ago

Serious question: If Safari doesn't support U2F/FIDO what good will a Lightning based Yubi key do me? To be clear, I'm not knocking the use of these keys. I have Yubi Nano on my laptop and love it.

brisance 7y ago
You can download Chrome, Firefox and Opera from the Apple App Store.

exabrial 7y ago

On an iPhone, will this work when you try to login to your google account in system prefs? It's been my experience with Bluetooth Fido keys that this does not work.

OJFord 7y ago

Does the 5C/Nano work with Android phones with USB-C? I thought I was waiting for a 5C NFC, but maybe I've been overlooking the obvious. For some reason it never occured to me that it might work plugged directly into my phone if only it had the right shape. (I have a 5 Nano, which was great until I got a USB-C Macbook and broke several keychain adapters before giving in and buying one of those hubs that stick on one side converting the 2x USB-C to the same + USB-A, HDMI, and SD.)

sgarman 7y ago
I have used the 5C with my Samsung Galaxy note w/o any issues, just plug it in the bottom.
hatfortguy 7y ago
This is what I do. The USB-C one's work on Android just fine but it's a little less intuitive; the YubiAuth app still complains if NFC is disabled and you might have to turn on OTG for the key to be recognised (which auto turns off on some phones after 10 mins).

s3cur3 7y ago

I was an early, enthusiastic adopter of Yubikeys at my work. Above and beyond the other issues people have mentioned, though, the one that kills the product for me is the frankly stupid OS integration. The key behaves like “just” a special kind of keyboard which types a long string of gibberish and then hits enter any time you touch the trigger. I can’t tell you how many times I have accidentally bumped the thing and thereby entered my secret key in: - text editors - the URL bar of my browser (!) - Slack chats (!!) The solution seems obvious to me: make a new type of input field at the browser and OS level which accepts U2F input, then reject that input in any text field that doesn’t opt in. This one issue has made the key way more of a liability than a simple authenticator app for me.

sigwinch28 7y ago
What are you talking about? The default configuration definitely does not type your secret key, but a one time password. The entire point of the default configuration is that the secret key is stored only on the device and never leaves it.
- sigwinch28 7y ago
  I should clarify: the secret key should never leave the device after configuration is completed.
raamdev 7y ago
The macOS YubiSwitch app solves that problem nicely. https://support.yubico.com/support/solutions/articles/15000006440-accidentally-triggering-otp-codes-with-your-nano-yubikey https://support.yubico.com/support/solutions/articles/150000...
LIV2 7y ago
If you’re not using both slots you can move the credential to slot 2 so that it requires a long press before it activates
PStamatiou 7y ago
You can disable this OTP mode of the YubiKey with either the "Yubikey Manager" or more advanced "Yubikey Personalization Tool" software. It's unrelated to FIDO U2F. It's the first thing I do with any new key as I find it similarly annoying.. I accidentally tapped it once while working in Adobe Lightroom and it triggered a sequence of actions that went on for 30 seconds that I couldn't undo..