3 ms·
I use a Yubikey daily and the OP is greatly exaggerating the issues in my opinion. Vanguard for example it took less than a minute to set up. I don't have an
by nightski 6y ago
I use a Yubikey daily and the OP is greatly exaggerating the issues in my opinion. Vanguard for example it took less than a minute to set up. I don't have an "application" installed locally for the Yubikey, it was plug & play. No special software needed.
I honestly think Yubikey type devices' largest problems are -
1. Marketing. People simply do not know they exist or how they work (simple or not).
2. Support - Many websites do not support Webauthn yet. We really need developers and businesses to consider this a priority.
I have bought some keys for my family members and they love them once I demonstrate how they work.
- guenthert 6y agoPrice. Yubikey's "best seller" goes for $45, that's grotesque. I would be surprised if the hardware costs exceeds $2 per unit and the software (or similar) can be had for free.
- bsder 6y agoIt's not about the hardware. In spite of the fact that they can nominally be broken into, most modern USB microcontrollers can easily implement being a security key. The expense is that the security world hasn't converged on anything remotely approaching a single standard. So, a key has to support ... PGP, OpenSSH, FIDO, FIDO2, U2F ... For example, you couldn't use some of the older YubiKeys with AWS because AWS only supported time-based TOTP. That's a LOT of software work, and you can't be "Startup Sloppy" with your code or someone will break it.
- upofadown 6y agoThe PGP thing is wildly different than the other applications in that it is a complete airgapped system on a key. The decryption and signing is actually done on key so the private key isn't exposed. PGP is pretty much the only thing that does this and as a result can be held up as an example of where we do in fact have a unique standard.