Hacker News Reader

Comment by lambada | Hacker News Reader

Flicking between the comparison tables at https://www.yubico.com/products/yubikey-hardware/compare-yub... and https://www.yubico.com/products/yubikey-hardware/compare-yub...

it appears like the only differences between YubiKey 4 and Yubikey 5 NFC is i) the addition of NFC and ii) the addition of FIDO 2 support

The differences between Yubikey NEO and YubiKey 5 NFC appear to be i) The addition of docker login support (?!); ii) FIDO 2; iii) RSA 4096 (PGP) support and iv) ECC p384 (not in PGP) support.

With that in mind.... how widely is FIDO2 deployed? I haven't yet found a two factor app supporting app/site that doesn't support my Yubikey 4.

View on HN

5 is like a merger of NEO and 4, NEO has NFC and 4 has 4096 RSA keys. And then there is FIDO2 but until it's in widespread usage U2F works fine.

IIRC the NEO only does TOTP over NFC. It sounds like the 5 does U2F over NFC, now?

U2F over NFC works on the NEO; I've been able to login to GitHub through Chrome with the Google Authenticator Android app. Same with Google account login on Android when adding an account to the device

NEO also does OpenPGP over NFC on Android. iOS only recently started opening up NFC to non-Apple developers.

The neo doesn't do totp at all (nfc or otherwise). It will do hotp, fixed response, and a challenge-response mode over nfc. It might do more but I haven't used them. I'm currently using the challenge response with keepassxc over USB and keepass2android over nfc. It's been working great

Oh, interesting! That's not called out on their comparison chart for the NEO. That would certainly be a tempting upgrade for any NEO users then

Now I've only got one problem remaining: how do I upgrade my old U2F-capable NEO on all the websites? Do I have to keep it with me ad infinitum? I cannot really destroy it either, as I cannot be 100 % sure I've remembered to enroll my new Yubikey 5.

This raises a more generic question: What's the proper upgrade path for hardware authentication tokens?

> This raises a more generic question: What's the proper upgrade path for hardware authentication tokens?

This is the reason why I'm still using only a password manager. I agree that a hardware token more security but the lost/stolen/change key problem is really not easy right now.

I hope there will be a new common API to change all enrollment you have done but it seems hard as the key don't even know them.

Maybe in a future version ?

The only one with Fido2 at the moment I know is Microsoft Outlook/Office365.

Reply on news.ycombinator.com