back to article Remember the Titans: Yubico jangles new NFC and USB-C touting security key

Security token biz Yubico has a new key out today, its latest-generation two-factor encryption (2FA) authentication unit, the Yubico 5C NFC, which includes support for PCs and mobile devices using USB-C, as well as a built-in NFC radio. Previous generations of the Yubikey have had USB-C and NFC, but not in a complete package. …

  1. Beeblebrox

    Standardise 2FA

    There's no point buying one of these until all the providers one uses (e.g. banks) are required to offer a standards based, non SMS 2FA.

    I have a multitude of 2FA devices lying around, a rare few of which are compatible to some degree between providers.

    1. john.jones.name
      Mushroom

      standard = Webauthn

      Webauthn :

      It is currently supported in Windows 10 and Android platforms, and Google Chrome, Mozilla Firefox, Microsoft Edge and Apple Safari (both mobile and desktop) web browsers.

    2. Bogle

      Re: Standardise 2FA

      Really handy because you can keep your PGP keys on them, and all of my passwords are in 'Pass: The Standard Unix Password Manager'; I can use it as 2FA for GitHub and Google; and the Yubico Authenticator app handles all my OAUTH 2FA needs. There's really no competition.

    3. DS999

      Re: Standardise 2FA

      I'm still surprised that neither Apple nor Google have tried to build 2FA into their phones. Just standardizing the sort of "type in the 6 digit number that appears on the screen after entering your PIN" type of 2FA that a lot of corporations use for accessing their network from a laptop at home would be a win.

      It will need one of those big players to do it to standardize. Banks aren't going to get together and standardize on their end, that's the wrong way around. Build it, and the banks will come (though obviously using your phone as the 2F for a banking app you access from your phone isn't ideal, but it is way better than using SMS messages to that phone as most currently do)

    4. big_D Silver badge

      Re: Standardise 2FA

      The Yubikeys support most of the 2FA standards that are currently in use (at least, dongle based methods). They are also programmable, so additional methods could be added.

      I've been using keys for about 6-7 years for providing 2FA on LastPass and for Microsoft, Google and a few other services. Just holding the key against my smartphone to unlick LastPass is great - worked with my old Lumias and with my Android phones.

  2. Anonymous Coward
    Anonymous Coward

    And still no…

    … RSA3072 or RSA4096 in PIV/SMIME mode. (Yup, I'm being squeezed between the rock of free mail cert that can't be ECC and hard place of gov't recommendation to sunset RSA2048 essentially right now. As is essentially the entire higher education community here.)

    1. Anonymous Coward
      Anonymous Coward

      Re: And still no…

      The PIV standard doesn’t allow RSA above 2048. It went straight to ECDSA.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2020