Hacker News Reader

Comment by nikanj | Hacker News Reader

I have an iPhone and a Macbook. It's frustrating that I have to choose between USB-C support for the Macbook, and NFC support for the phone. It's odd that they don't make a USB-C version with NFC.

View on HN

It's a few months away, but we'll have usb-c + nfc in Solo (open source security key supporting FIDO2). We'll launch the Kickstarter next week: https://solokeys.com

Very nice. Does it support FIDO2 only or are there other applets (e.g. OpenPGP)?

We're starting FIDO2/U2F only, but we'll have the possibility to upgrade the firmware. PGP/SSH are the top feature requests, so we'll add them right after the Kickstarter -- unless the community builds them first.

Ciao Emanuele, just dropped a linkedin connection request. I am working on a product that would benefit from solo, would love to pick your mind sometime in near future.

According to them, it's because "there isn't room on the USB-C devices for an NFC antenna": https://twitter.com/i/web/status/1044254654366769152

How big is the NFC antenna?! The size difference of 5C and 5C nano is pretty big but if it still can't fit the antenna then it must be huge

The YubiKey 5C is really quite small in comparison to the normal YubiKey 5.

The 5C nano is designed to be plugged in the all the time though, so in that scenario what do you really gain from NFC?

Because one day we'd like to securely authenticate to things on phones in phone browsers. (I agree that it's not a big a deal as one may think; it only matters if you're logging in to a critical service via the browser and not the app. If you're using the app, it's the app's problem to make sure that you're talking to the Correct Service(TM), so phishing concerns go away.)

BLE solutions are going to work much better for mobile devices than NFC I think. Google already supports it for their apps via SmartLock and Advanced Protection on both major mobile platforms. Its the browsers, and namely Safari, thats being the blocker on iOS right now - both for NFC and BLE solutions.

It works in iOS Chrome but only on Google properties. I agree Safari is a problem, I’m not sure it’s the only pinch point. They managed to glue it all together with app links and URL schemes.

(Chrome on iOS works fine with Krypton on the same phone, effectively giving me the SEP U2F I want, just with gross UX.)

> BLE solutions are going to work much better for mobile devices than NFC I think

Yubico would disagree. According to their research studies BLE devices are harder to use and less robust.

Source: https://www.yubico.com/2016/06/yubikey-u2f-tracking-bluetoot...

That makes sense. I generally don't use my phone to log into anything that requires 2FA, so that didn't even occur to me. For whatever reason, most of the services I use that require 2FA tend to be pretty useless on mobile web.

Contrary to (at least the 4 series-era) Yubico's marketing materials, their Android app works fine with USB (in fact better than with NFC), so if you have and Android phone with a USB-C port, you can plug in a USB-C Yubikey directly (or a USB-A Yubikey with an adapter).

Once browsers on Android support WebAuthn, it may well be that plugging in a USB-C Yubikey will be more convenient than trying to locate the position of the NFC antenna.

Anyone who routinely uses tap-to-pay will already know how to position their phone for NFC functionality. Here in Canada, support for tap-to-pay in point of sale systems is near-ubiquitous. Not 100%, but it's it's very much the exception for it not to be supported.

Financial institution support for phones as the source of the payment tap is spotty here, but definitely growing. Contactless cards are the longer-standing way for Canadians to use this method.

Being able to use it with my phone?

There is the 5C (non-nano) where that argument doesn't apply anyway.

Reply on news.ycombinator.com