Hacker News Reader

Comment by adrian_mrd | Hacker News Reader

How does one use a U2F / YubiKey on a mobile device like an iPhone (lightning port), or are they only compatible with laptops and Android phones (USB-2, USB-C, USB-3) connections?

View on HN

You have to get the version that works on mobile (Neo?) which uses NFC to connect to the phone. It works properly on Android.

Due to some restrictions from Apple it doesn't work well on IOS yet:

https://www.yubico.com/2017/10/iphone-support-yubikey-otp-vi...

On Android, you have plenty of options and they all work. Specifically, my Neo key works with NFC and my YK4 works with USB OTG (both original flavor and USB-C).

Apple limits the capabilities of Yubikeys so much that it's best to summarize it as "Doesn't work". It's more of Apple's anti-competitive restrictions that seem to go unnoticed by most people because they have a shiny UI.

Thanks for that info.

So, then, if Apple wanted to adopt a similar solution to Google - i.e. for their own enterprise security, as opposed to for their customers - could they use one of the Yubikey NFC options, or, would they have to ‘create’ a Bluetooth-specific device?

Maybe the long-rumoured Steve Jobs ring could take the form factor?!

And from an Apple customer perspective, is there a valid argument to be made that iOS devices can be, or are currently, less secure than Android counterparts because of the current lack of Yubikey / U2F options?

The Yubikey NEO recently supports iPhone 7 and up: https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-...

With some limitations, at least in iOS 11:

“Besides the fact that the NFC Reader interface can only be fired up from an app, Core NFC [in iOS 11] does not allow for write operations that are required for authentication protocols like FIDO U2F. ...

However, because NFC tag reading is supported, it allows developers to build apps, including consumer facing or purpose-built enterprise applications, with one-time passcode (OTP) support.”

Which is what ‘smiley1437’ and others have effectively stated in other parts of this thread.

edit: added last sentence

There is a NFC Yubikey which you can tap against your phone to log in.

There is also a bluetooth version which is not manufactured by Yubikey.

https://www.amazon.com/dp/B01LYV6TQM/?coliid=I3IA8VD7QRRZDT&...

The protocol specifics 3 transport options with this in mind: usb, nfc, and Bluetooth.

As others mention, nfc works great for android. Bluetooth is your only option for iOS, and it’s clunky because you have to deal with pairing.

I asked the same question earlier, then found out that Yubikeys can work with a lightning-USB adapter.

[1]https://support.yubico.com/support/solutions/articles/150000...

Thanks, good to know.

Again iOS 11 only supports the One-time password (OTP) featureset:

“When a YubiKey is connected to an iOS device, only the OTP mode functions listed below are available. Yubico OTP Static Password OATH-HOTP”

Does anyone know if iOS 12 will update Core NFC to overcome: “Core NFC [in iOS 11] does not allow for write operations that are required for authentication protocols like FIDO U2F.” [1] https://www.yubico.com/2017/10/iphone-support-yubikey-otp-vi...

iPhones and high-end Androids have their own secure elements these days. I’d expect the OSes will eventually provide their own hardware-backed U2F APIs that you enroll directly, rather than piggybacking tokens. Same for corporate laptops with TPMs.

Good point, that makes a lot of sense with Apple’s hardware strategy in mind.

People already mentioned the NFC, but you can also use the key on another secured device (w/ USB) to generate an OTP for the phone login. This still requires using the key to get the temporary OTP.

Reply on news.ycombinator.com