12 ms·
YubiKey Bio Series
- kosasbest 5y agoInteresting spin on the usual method of: - Something you know (password) - Something you have (hardware token) Now with the Bio it's also: - Something you Are
- warp 5y agoAt $85 for the USB-C version it is surprisingly expensive (In my mind these Yubikeys have all been around $50). And it only supports FIDO/Webauthn/U2F -- so you cannot use this with the Yubikey authenticator app to store TOTP tokens.
- deleted 5y ago[deleted]
- saxonww 5y agoI bought some Yubikey standards back in 2014 and they were $25 apiece. The Yubikey 5 NFCs I got 4 years later were $45 apiece, but had NFC and did more stuff. They released some U2F-only yubikey security keys that I thought were $20 but I am not sure (they were blue, and cheap). Now these, which the site suggests can only do U2F/Webauthn with fingerprint, are $80. I think it's cool to have a portable fingerprint-secured webauthn token, but it's disappointing to see them so expensive. I wonder if this is the long-term price, or if they are more expensive temporarily due to supply chain issues or something like that. Or, maybe they are substantially cheaper in bulk.
- staticassertion 5y agoGiven that they're limiting the number of them that a given customer can buy I suspect that the price is in part the supply.
- frankjr 5y agoThere are budget smartphones you can buy under hundred bucks (Cubot Note 7). Charging $85 for this is ridiculous.
- chiefalchemist 5y agoYes and no. For me the $85 feels expensive compared the other YubiKeys I own. On the other hand, if the $85 stops one "event" then the price is low.
- willis936 5y agoIt's just hard to swallow when the BOM is $10 and the hardware is simple. Nothing about it is magic.
- chiefalchemist 5y agoWhat other alternatives are there?
- rPlayer6554 5y agoLooks cool, but sad there is no NFC support.
- luis8 5y agoI wonder if the limitation is power. Can a fingerprint scanner be powered by NFC? OTOH in my specific use case, I only use the NFC with my phone, the USB-C version should take care of that
- notemaker 5y agoYes, see e.g https://www.zwipe.com/ https://www.zwipe.com/ But would of course depend on the sensor. Zwipe uses a sensor from the Swedish company FPC
- cbsmith 5y agoEven in that case, NFC is just so much more convenient than USB-C (and you don't have to worry about wear & tear on the connector).
- staticassertion 5y agoThis looks like it might be a bit of an early testing-the-waters, or even a one-off to satisfy a specific set of customers (note that they're FIPS compliant only). If there's more traction I would expect future models to include more features.
- bilalq 5y agoTo me, form factor is a bigger limitation than lack of NFC support. I'd mostly want this replacing the 5C Nano I leave in the laptop that actually travels with me. A clunky key like this would have to be left for desktop use.
- staticassertion 5y agoYeah, that's a tradeoff for sure. Until they find a way to fit a biometric reader into a 'nano' form factor at least.
- jolmg 5y agoNo OpenPGP Smartcard support, I see. :(
- jordemort 5y agoI would probably buy it if it had OpenPGP support
- jolmg 5y agoMe too. OpenPGP is super flexible and this would've been an upgrade to 3FA for everything I use it for.
- rkeene2 5y agoMost of the YubiKeys support PIV (NIST SP 800-73) mode, which gets you X.509 support (and a PKCS#11 module), which has much broader support than PGP.
- staticassertion 5y agoThe Bio series does not support PIV/PKCS#11 at this time afaik
- nixpulvis 5y agoWhat are the alternatives now? I never really liked the Yubico stuff, though I have to admit that their hardware is well made.
- jolmg 5y agoI don't know of a similar product that supports tap-prompts and blinking lights[1] like Yubikeys do. Yubikey 4/5 still seem to be the best, IMO. [1] https://news.ycombinator.com/item?id=28765982 https://news.ycombinator.com/item?id=28765982
- tialaramex 5y agoIf you wanted OpenPGP to protect SSH, you should consider upgrading clients and servers to a modern OpenSSH which can just speak FIDO (which this and other recent Yubikeys support)
- amelius 5y agoCan someone explain why this makes authentication more secure? If I tap the device while a malicious process is attempting to access another machine in the background, what good does this device do?
- deleted 5y ago[deleted]
- jolmg 5y agoNot with the Bio series apparently, but at least on the Yubikey 4, when you're setup with OpenPGP, a tap works with a single request and it prompts you to tap with a blinking light. If it's blinking when you haven't done anything to prompt a tap, that would be something to worry about. If you do something that prompts a tap and a malicious process also requests something from the key at the same time, you'll get 2 requests. You'd tap it for the request you're expecting, see it blinking faster to confirm your tap, and then blink slowly again to request the 2nd tap. That second request would be your cue for worrying. IOW, the blinking is an alert against your scenario.
- amelius 5y agoOk, thanks! How do well does this key go together with workflows that use automation (e.g. daily rsyncs over the network that run in the background)?
- jolmg 5y agoNot sure how you want to combine automated daily rsyncs with hardware keys. You can use OpenPGP for ssh authentication, and set it up so it prompts you when rsync starts automatically. However, do you really want your automated jobs to depend on having a human to answer prompts or at least having a key inserted when it's scheduled to run? It sounds like there could be a better setup.
- amelius 5y agoMy issue is that once I start using authorized_keys for automated processes, then it defeats the purpose of the key.
- kingcharles 5y agoIf you care about your security you will not use biometrics as the only means to secure your data. In the USA at least some courts have ruled that force can be used to make you unlock devices protected by only biometrics. See, e.g. https://www.biometricupdate.com/201912/federal-state-court-rulings-on-whether-biometrics-protected-by-fifth-amendment-get-murky https://www.biometricupdate.com/201912/federal-state-court-r...
- eykanal 5y agoIts pretty well known that fingerprints _by themselves_ are a pretty poor replacement for passwords. (a) They're public, in that it's pretty easy to get someone's fingerprint... just find something they touched recently. (b) If they're compromised its impossible to change them. I don't think this gets around either of those points, but I am curious if this somehow makes it much more difficult to either compromise the fingerprint hash (fingerprint fingerprint?) or makes the resultant hash less useful once compromised.
- wnevets 5y ago> Its pretty well known that fingerprints _by themselves_ are a pretty poor replacement for passwords. (a) They're public, in that it's pretty easy to get someone's fingerprint... just find something they touched recently. (b) If they're compromised its impossible to change them. I'm a bit more worried about Russian ransomware operators getting my passwords than my fingerprint.
- executive 5y agoeven if they chop off your hand?
- wnevets 5y agoIf Russian ransomware operators want to even attempt to chop off my hand I would need to start making much more interesting life choices that I have been.
- staticassertion 5y agoTime to add an embedded EKG as another factor :)
- bsza 5y agoIf the police/border protection/etc ever took your fingerprints, don't worry, they'll get to them too. Maybe with even less effort than would be required for your password, depending on how diligently you protect your passwords.
- yegle 5y agoThe cookie preference on the website is impressive. By default only necessary cookies are enabled if you just click "Accept". You also have to explicitly enable the "functional cookies" to view the embedded video.
- robocat 5y agoDoes anyone else find fingerprint readers mostly unusable? I love them when they work, but my fingers are very often unreadable due to dirt, cuts, paint, oil, swimming or bath wrinkles, etcetera. I’ve had the problem with multiple devices (e.g. iPad, Nokia phone). Because I have to use the secondary authentication so much of the time, I find little merit in using a fingerprint for security.
- staticassertion 5y agoThe one to unlock my Samsung Galaxy whatever-number-it-is works pretty consistently.
- jolmg 5y agoAndroid supports registering multiple fingerprints to get around this. I wonder if that's also possible with this key.
- jcrawfordor 5y agoI'm with you, I've fallen out of the habit of using fingerprint auth on any of my devices that support it (Macbook, Thinkpad, Motorola phone) because it's so unreliable. I have to re-enroll at least weekly if I want to keep it working well. I have eczema issues on my hands, which I think is the main issue, but also have found cuts and paint/glue to be common problems. I can enroll multiple fingers but that means I have to try four fingers before it unlocks... and usually I end up enrolling the same finger multiple times instead since the device has stopped recognizing it. For what it's worth I used to have a job that involved frequent use of an optical fingerprint reader (the type that's a camera behind a glass platen) and did not have these types of problems with it. I think it's a weakness of the capacitative type of reader that all devices are using now, or possibly just less sophisticated matching software.
- cainxinth 5y agoDon’t know if this works for others, but for Apple Touch ID you can solve the wet finger issue by adding another set of prints while the finger is wet.
- 1970-01-01 5y agoSomething you are, protecting something you have, which is designed for protecting something you know. 3FA is too much. Lose any of the 3 and access is denied.
- jolmg 5y agoYou can setup alternate valid credentials. For example, in the case of the "have", you can have multiple valid keys. In the case of the "know", multiple valid passwords. In the case of the "are", perhaps on this model or a future one, multiple valid fingerprints. You can also setup e.g. alternate 1FA with a really strong password.
- bsza 5y agoI know this analogy is not pedantic but it's fun to imagine the same argument with physical keys. Lose your hands and you won't be able to use your house key. Lose your house key and you'll have nothing to use. Lose your mind and you won't know how to use a key.
- 1970-01-01 5y agoThe house analogy does not work well. Finger cuts, hand casts, over-use of sanitizer, dirty, wet, or wrinkled hands, etc. will not only deny you access to your stuff, it will do so for an extended length of time. You will need to either fall back to 2FA or wait until your body returns to a previous state.
- bsza 5y agoYes, and forgetting a password is more likely than forgetting how to use a key. That's why I said it's not a good analogy. But it sounded so funny I had to get it out of my system.
- syntaxing 5y agoOff topic, but it’s so frustrating how yubikey (or any non SMS/email 2FA as a matter of fact) is not supported for any bank. I think I would sign up right away to a bank that supports yubikey or authenticator apps.
- ssklash 5y agoSame. I don't know of a single US-based bank that supports it.
- Redori 5y agoCharles Schwab supports it
- syntaxing 5y agoCan you bypass it with SMS? Or can you permanently disable SMS 2FA?
- enra 5y agoI don't think you can bypass it with SMS so if you get locked out you need to call them. Not sure how easy it is to bypass by calling them. But Schwab doesn't support hardware keys. Morgan Stanley is the only bank/financial company I know supports hardware keys.
- dyingkneepad 5y agoWhen they finally support it, I guess they will add the convenient option to say you don't have your yubikey with you at the moment and then an SMS will be sent instead.
- syntaxing 5y agoYou just described Vanguard. What’s the point of yubikey support when you can bypass it with SMS….
- zxcvbn4038 5y agoI don’t buy into the “passwordless” designs. A fingerprint scanner might be better then a touch sensor but in the end it’s still a single factor. I meet a lot of people who bought yubikey nanos and leave them plugged in all the time. Defeats the purpose. There should be a kiosk where you can exchange people’s unattended yubikeys for a cookie or some other treat. That would take care of that problem.
- ghostpepper 5y agoDoesn't Yubikey design them to be left plugged in all the time? I don't see how it compromises the security at all
- packetslave 5y agoDepends on which Yubikey. The nano series (aka the "gnubby") are designed to be permanently plugged in. The 5 and 5C are designed to live on your keyring.
- arianvanp 5y agoWhen Webauthn requests user verification on a non-bio yubikey user needs to provide a (6 digit) pin.
- _zoltan_ 5y agoit absolutely does not defeat the purpose: if you somehow manage to get my password/ssh key _remotely_, there is still one more obstacle you cannot get as it's _local only_. that is why it's a second factor. something you know with something you have. I'd say this covers the 99% of how credentials are being misappropriated.
- loosescrews 5y agoThe yubikeys are designed to be non-clonable, so it is two factors: something you have and something you are. Not all factors are created equal, and in the past there have been issues with biometrics not really being a reliable indicator of something you are.
- 1123581321 5y agoIs it possible for a retail user (no domain, AD, etc.) to use a YubiKey as a Windows Hello second factor? Forgive me if this is obvious; I’ve spent a lot of time googling and I only come up with references to using in context of enterprise device/user management. Because if YubiKeys could be used, this seems much better than the typical cheap USB fingerprint readers that are for sale.
- eightysixfour 5y agoYes, Windows can use a Yubikey for Windows Hello either to unlock the device (not login) or as a second factor for anything else supporting Hello.
- gorgoiler 5y agoYubikeys, for me, are convenient second computers for burying private key material that is only accessible via the physical presence check. I feel I am 10,000x more likely to be attacked from inside my computer by a digital intruder than from any other vector. I lock my Yubikeys with a PIN but I’m not convinced it really protects me against anything that might actually happen to me. Jason Bourne, I am not. If you, on the other hand, face targeted physical threats on the daily then you have my sympathies. Stay safe. (Ps: any recommendations for an HSM with a more exciting presence check? I’d like to shoot a hoop / shoot a tin can / shoot a shot of wheatgrass every time I log in, rather than just press an ambiguously hello/green blinky light.)
- jiveturkey 5y agoYour question implies that the yubikey is an HSM. It isn't. It has a secure element. If you want to implement your own novel test of user presence, you could get an F-Secure USB armory device (https://www.f-secure.com/en/consulting/foundry/usb-armory https://www.f-secure.com/en/consulting/foundry/usb-armory) and tap into the GPIO.
- FuriouslyAdrift 5y agoYubico does, however, make an actual HSM. https://www.yubico.com/products/hardware-security-module/ https://www.yubico.com/products/hardware-security-module/
- jiveturkey 5y agoby name only. it is also not an HSM by commonly understood definition. epoxied chip isn't enough to declare HSM-ness
- FuriouslyAdrift 5y agoI was on a team that evaled it for FIPS compliance. It's a full, FIPS compliant, HSM. It's $650 but that's still on the low side for an HSM.
- alexandrerond 5y agoI was so excited to read this because I thought Yubico had finally launched implantable NFC yubikeys that we could carry under the skin. Too bad it's just a fingerpirnt sensor.
- nikolay 5y agoTheir strategy is to never launch a fully-featured key so you keep upgrading. For example, this $85 thing does not have NFC. I am not playing their game anymore. I'm pretty fine with my old YubiKeys.
- EastOfTruth 5y agousing a publicly known login that you can't change (fingerprints) as a password is probably not the greatest idea...
- aborsy 5y agoNo OpenPGP support means users won’t be able to use Pass password manager and GPG to lock down various stuff? Then, I won’t downgrade! It’s worth mentioning, it doesn’t seem to be FIPS validated. It therefore doesn’t meet US government requirements (see NSA guidelines). I don’t know how much this is important in practice.
- htrp 5y agoDo Yubikeys work with USB A to C adapters?