Hacker News Reader

Comment by arusahni | Hacker News Reader

IIRC the NEO only does TOTP over NFC. It sounds like the 5 does U2F over NFC, now?

U2F over NFC works on the NEO; I've been able to login to GitHub through Chrome with the Google Authenticator Android app. Same with Google account login on Android when adding an account to the device

NEO also does OpenPGP over NFC on Android. iOS only recently started opening up NFC to non-Apple developers.

The neo doesn't do totp at all (nfc or otherwise). It will do hotp, fixed response, and a challenge-response mode over nfc. It might do more but I haven't used them. I'm currently using the challenge response with keepassxc over USB and keepass2android over nfc. It's been working great

Oh, interesting! That's not called out on their comparison chart for the NEO. That would certainly be a tempting upgrade for any NEO users then

Now I've only got one problem remaining: how do I upgrade my old U2F-capable NEO on all the websites? Do I have to keep it with me ad infinitum? I cannot really destroy it either, as I cannot be 100 % sure I've remembered to enroll my new Yubikey 5.

This raises a more generic question: What's the proper upgrade path for hardware authentication tokens?

> This raises a more generic question: What's the proper upgrade path for hardware authentication tokens?

This is the reason why I'm still using only a password manager. I agree that a hardware token more security but the lost/stolen/change key problem is really not easy right now.

I hope there will be a new common API to change all enrollment you have done but it seems hard as the key don't even know them.

Maybe in a future version ?

Reply on news.ycombinator.com