Hacker News Reader

Comment by kossae | Hacker News Reader

I thought Yubikey NEO supported NFC on iPhones. I remember reading there was some flaky support for a while, then a new SDK was released for iOS 11. Is there any advantage to using the pluggable Lightning Yubikey over the NEO? Perhaps better app support?

View on HN

NFC support is spotty at the moment. The problem is that it's somewhat simpler to integrate FIDO/U2F via browser using the WebAuthn API than it is to implement a non-native FIDO SDK into your native app in a secure fashion. Once mobile browsers and iOS/Android web UI widgets get support for BLE and NFC WebAuthn, things should improve somewhat.

FIDO (WebAuthn) via browser abstracts some nuances from you such as "how do you know you can trust the server you're talking to?" and "how do you deal with the difference between FIDO and FIDO2 authenticators?" alongside other details that the native SDK's don't abstract away from you.

(For background: part of my day job is implementing authentication systems.)

The NEO is a Yubikey v3. It supports NFC. v3 is the last FOSS one, but it does not support FIDO2. If you want a YubiKey with NFC which supports FIDO2, you need a YubiKey 5 (NFC version). Or a Solo with NFC (the Solo support FIDO2 and is FOSS).

I happen to have one of the InCharge chargers as keychain [1] and what is interesting is that it is 3 chargers in one: one's always USB-A, other one is either USB-C or microUSB/lightning. So they combine microUSB with lightning on the same connector. I wonder why YubiCo did not go with a similar design.

[1] https://www.indiegogo.com/projects/incharge-universal-one-ca...

In my experience too with testing the NEO, they're just not as reliable to work with compared to the later models (both over NFC and USB). I believe the NEO was the first to bring in new features for the Yubikey, and the kinks weren't all ironed out yet.

If you have a NEO still, I'd recommend at least upgrading to a 4 if you can.

My NEO is my backup key. My YubiKey Nano 4 is my main key. I also got 2 Solo, but they only do Fido 2 (not SC) so they're not very useful for me. Though one will, once I got my next phone (will have NFC).

If there's a way for 1password to work over NFC on iOS, i'd be happy. Still, I bought a lightning/usb-c key this morning.

Reply on news.ycombinator.com