Hacker News Reader

Comment by jotux | Hacker News Reader

>I trust the secure element on the iPhone a lot more than I trust the hardware on the Yubikey.

Why?

I don't know about the OP, but for me the reason is that it's made by a company with a much bigger profile than yubico

This means that it's under much higher scrutiny by the public. Due to that big profile I also expect security issues to be fixed quickly as Apple has much more reputation (and money) to lose than Yubico.

Finding exploits in the iPhone's secure element gains you much more fame than finding exploits in the Yubikey.

And finally, Apple has come out very publicly against aiding law enforcement and has a much bigger war chest to fight requests by law enforcement.

Yubico has neither.

But an Yubikey is a passive and isolated device: it doesn't turn itself on, it doesn't run any apps, it doesn't connect to the internet. And if it gets compromised (stolen or exploited), it's cheap enough to throw it away and to replace it with a new and improved version without any hassle.

Stealing a Yubikey gives you immediate access to the 2nd factor, and I might not notice right away.

Stealing my iPhone gives you almost zero chance of accessing the second factor, I would notice a lot quicker, and I could revoke access (remote wipe) with a single click versus having to re-enroll a new 2FA at every single site individually.

You can password protect the Yubikey. That's how mine is setup. Adds an extra step, but I don't worry about losing it.

In my eyes, the Yubikey is a bespoke toy compared to the latest-gen iPhone Secure Element.

Apple just has a lot more riding on their chip, and since they first introduced a secure element back in 2014 have spent perhaps 2 orders of magnitude more dollars on security R&D than Yubico ($4mm angel round in 2007, $30mm raised in 2017)

Apple’s secure element is in, what, more than a billion devices, and powers how many billions in Apple Pay? Yubikey by comparison ships devices that mostly nerds pile in their sock drawer with those old USB sticks they don’t use anymore.

But are there fundamental reasons why yubikey isn’t good? The amount of money spent doesn’t mean yubikey isn’t good, and they’re trying to accomplish different things (yubikey doesn’t have an OS running Facebook on it that could be used to attack itself, nor does it try to authenticate its secrets beyond a button press).

Note Google uses Yubikey to authenticate it’s employees into their laptops — hardly just nerds piling in their sock drawer.

Reply on news.ycombinator.com