Hacker News Reader

Comment by Mizza | Hacker News Reader

At the risk of sounding like a complete schmuck - how do I actually use this?

It look like it's a dev board, the kind of thing I'd get on SparkFun or whatever, but I get the impression it's a consumer product. Do I plug it into my computer, and it runs software? Do I press the button, then it blinks out a password via LED at me? Does it connect via bluetooth to.. something? Who writes the local software? You? Google? Me?

I love your write-up and I dig your hustle, but I think the final 10% "polish" is the missing piece here! Good luck!

View on HN

Haha good question.

Yubico has a good explanation:

https://www.yubico.com/products/yubikey-hardware/fido-u2f-se...

It's the same as any other U2F token. You register it with a service that supports U2F (Google, Github, Duo, etc.) and then present the token and press the button upon logging in later.

No software or drivers needed. It's an HID device so all normal operating systems will support it.

Ummm... can you please include an explanation on your website that makes sense to non-developers who haven't heard of either Yubico or U2F before?

"It's the same as any other U2F token" is meaningless to a rather significant proportion of humanity.

Could I use this if I want to access apps on my Android phone?

It's a keyboard so otg will work

You push the button and it'll send 6 digits as a keyboard it's like 2fa

That's not correct. A U2F device cryptographically signs signed challenges with a key that never leaves the device. (Yes, it signs a signed challenge. That's not a typo.) The issuer of the challenge verifies both signatures to confirm that the user possesses the device and that the issuer genuinely issued the challenge embedded in the signed response.

Unlike the OTP token you're describing, a U2F device is effectively stateless. And unlike an OTP token, its signing mechanism is resistant to phishing. Finally, a U2F device is not a HID keyboard, contrary to your other comment on this page. But it is a HID-compliant device.

Reply on news.ycombinator.com