YubiKey Gains iOS SDK to Enable Secure 2FA Logins in Select Apps Using NFC

Just doesn't work with enough services I actually use. At a minimum amazon needs to support it. And of course more online stores and services.

The Yubikey can implement multiple schemes. One protocol here is called Yubico OTP. This is a Yubico proprietary HOTP-like scheme, and relies on a shared secret held by Yubico. It is a one-way protocol, which means that it can be handled via iOS's read-only NFC support. It is broadly similar to OATH HOTP, but again, to eliminate provisioning, it, by default, relies on a shared secret installed and held by Yubico and their verification servers. (You can overwrite this with a custom server and verify yourself). The major weakness of this scheme is that it is not resistant to man-in-the-middle attacks.

OATH HOTP is a second option. That is the event-based Authly/Google Authenticator. It requires individual provisioning, does not require a trusted third-party, but does nothing to protect against MITM.

The Yubikey can also implement U2F, which does protect against man-in-the-middle attacks. However, U2F requires two-way communication with the fob, which cannot be done with the current NFC framework in iOS. The solution is that there are a number of BLE U2F tokens, which do work with iOS.

In my opinion, because Yubico OTP is obsolete. It relies on Yubico's servers and secrets and does not protect against MITM like U2F does. It is similar to other services now gone (Symantec VIP).

konqerror, you analysis is SPOT ON! YubiOTP is still a "shared secret" solution. Yubico has taken the shared secret model about as far his it can. It's really a combination of both HOTP and TOTP, there is a counter element and a time element, as well as some other data that is incorporated into the OTP that is genereated. Self Hosted OTP validation server is rather easy, that's what I do at home.

Completely agree that U2F is much better. It's a modern, asymmetric encryption solution. Unfortunately, it only works with web based services today, and requires a web browser that understands U2F. Currently only Chrome and Firefox. FIDO2 should remove these limitations and open up this functionality to not web services. I am looking forward to having FIDO 2 support for everything!

I also hope that Apple will open up the NFC interface to third party developers soon. That would be a great win for ALL customers.

I have looked at the BLE stuff. Still not as easy to use as the Yubikey. Requires a battery, and are considerably thicker that the Yubikey. I still have my original Yubikey I purchased in 2009. Still works, even after being washed at least twice.

Absolutely! That is a big issue. I request Yubikey support for every service I use. Have been asking my bank for YK support for many years. I finally got some traction over the last few months. Let's see what happens...

I have actually been successful in some cases with the requests. Many times, it's just that the services does not know about the Yubikey value. I have and conversations with a number of services and discuss this topic. Not all are open to the idea, but some are.

That's a good idea. I'll get a hold of my credit union. They seem very interested in adopting new technologies. Even though yubikey isn't new.
I'm surprised Chase isn't on the list. Or other major banks.

Never heard of YubiKey before, and since reading this I’ve done a little research. I have been using Authy up until this point, which I only have running on my iPhone (and not the chrome extension on macOS, as an example).

Is YubiKey far more secure than Authy? What are folks personal experience with using YubiKey on various websites? Have you completely replaced an authenticator app with YubiKey?

Also, does YubiKey work with Brave browser on macOS? I’ve seen reviews where it only works on Chrome, yet I’ve seen it mentioned on GitHub it has been in development for a couple years now.

In my opinion, yes the Yubikey is more secure. First, it's an external hardware token with a cryptographic engine on it. Authy (and Google authenticator, as well as others) use a "shared secret" That means that the web site you log into has your shared secret. If that is compromised, then all bets are of. Yubikey uses U2F, which is a public/private key solution. The web site does NOT have the secret key, only the public key. Even if they get your public key, a hacker cannot log in without your private key.

The YK also standard standardOTP (similar to Authy), as well as an enhanced Yubico OTP. As long as the web site supports Yubico OTP or U2F, you are good. OTP is independent of the web browser, it is based in the web site. U2F does require a compatible browser. Right now Chrome and Firefox are the only ones to support it. Hopefully Safari will be coming soon. MS will provide Edge support soon also.