3 ms·

What I see here is Yubico pushing for continued relevance while vendors, such as Microsoft and Apple, move to hybrid software hardware solutions with greater re

What I see here is Yubico pushing for continued relevance while vendors, such as Microsoft and Apple, move to hybrid software hardware solutions with greater recoverability and without having to carry another piece of hardware with you. I applaud Yubico for what they've done over the years championing hardware multifactor, improved awareness of multifactor, and further in standards and acceptance. However, unless they pivot their model towards the OEM market and start selling there chips to phone manufacturers, I can't see them ever hitting the mainstream. Both Windows Hello and Microsoft Authenticator (in passwordless mode) are brilliant examples of passwordless done in a secure way that is also incredibly user friendly to both use and set up.

dwaite 4y ago
> What I see here is Yubico pushing for continued relevance while vendors, such as Microsoft and Apple, move to hybrid software hardware solutions with greater recoverability and without having to carry another piece of hardware with you. I applaud Yubico for what they've done over the years championing hardware multifactor, improved awareness of multifactor, and further in standards and acceptance. One important aspect is that Web Authentication is an abstraction API for talking to an authenticator. The authenticators themselves can have wildly different policy/characteristics. Apple in particular is pushing exclusively toward the consumer space requirements with their current implementation of Passkeys, solely as a more secure password replacement. This means that clone ability and sharability are fundamental concepts for them, which currently go against business and regulatory requirements in several spaces. Since mandating creation of hardware-bound credentials goes against consumer usability, there isn't a clear path toward supporting them outside enterprise enablement via MDM. Android's current plans are to only support hardware-bound credentials for second-factor usage, not for passwordless usage. Microsoft will likely allow for user choice as to whether a credential is hardware-bound. I'm not aware if they will allow the relying party to dictate a requirement here. Yubico meanwhile has a FIPS-certified key, and has been pushing toward support at higher assurance levels per NIST 800-63. While additional hardware is annoying for users, to the business it amounts to a per-seat cost to solve a real problem. > However, unless they pivot their model towards the OEM market and start selling there chips to phone manufacturers, I can't see them ever hitting the mainstream. They have an interesting model in that, while a business may need a user to have a Yubikey or similar authenticator, there often isn't a requirement that they have one specifically provisioned and shipped by the business. I've seen environments where key fobs are provisioned to users primarily through Amazon. So I suspect Yubikeys will settle into a business user and prosumer space, but no the chance of widespread consumer adoption was always slim. The broader adoption of WebAuthn gets however, the more opportunities I think Yubico will have to sell into the gaps. [Disclaimers: WebAuthn WG member, FIDO 2 TWG vice-chair]

dwaite 4y ago

> What I see here is Yubico pushing for continued relevance while vendors, such as Microsoft and Apple, move to hybrid software hardware solutions with greater recoverability and without having to carry another piece of hardware with you. I applaud Yubico for what they've done over the years championing hardware multifactor, improved awareness of multifactor, and further in standards and acceptance. One important aspect is that Web Authentication is an abstraction API for talking to an authenticator. The authenticators themselves can have wildly different policy/characteristics. Apple in particular is pushing exclusively toward the consumer space requirements with their current implementation of Passkeys, solely as a more secure password replacement. This means that clone ability and sharability are fundamental concepts for them, which currently go against business and regulatory requirements in several spaces. Since mandating creation of hardware-bound credentials goes against consumer usability, there isn't a clear path toward supporting them outside enterprise enablement via MDM. Android's current plans are to only support hardware-bound credentials for second-factor usage, not for passwordless usage. Microsoft will likely allow for user choice as to whether a credential is hardware-bound. I'm not aware if they will allow the relying party to dictate a requirement here. Yubico meanwhile has a FIPS-certified key, and has been pushing toward support at higher assurance levels per NIST 800-63. While additional hardware is annoying for users, to the business it amounts to a per-seat cost to solve a real problem. > However, unless they pivot their model towards the OEM market and start selling there chips to phone manufacturers, I can't see them ever hitting the mainstream. They have an interesting model in that, while a business may need a user to have a Yubikey or similar authenticator, there often isn't a requirement that they have one specifically provisioned and shipped by the business. I've seen environments where key fobs are provisioned to users primarily through Amazon. So I suspect Yubikeys will settle into a business user and prosumer space, but no the chance of widespread consumer adoption was always slim. The broader adoption of WebAuthn gets however, the more opportunities I think Yubico will have to sell into the gaps. [Disclaimers: WebAuthn WG member, FIDO 2 TWG vice-chair]