I learned a lot digging into FIDO2 and U2F standards for hardware key authentication after today's big Microsoft embrace (cnet.com/news/microsoft… — log in without a password). But there are lots of caveats. Thread: 1/
Security key maker @yubico doesn't support Bluetooth for reasons of security (30m range means danger of connecting to wrong device) and engineering (pairing sucks, battery required). Some discussion here: yubico.com/2016/06/yubike… 2/
2. NFC limitations on iPhones make one-time passwords awkward (needs an app) and make FIDO impossible. (yubico.com/2017/10/iphone…) Yubico working on using the Lightning port for older FIDO U2F standard. Again, will need an app to work. yubico.com/2018/08/yubico… 3/
USB-C Yubikeys work on USB-C-equipped Android phones (support.yubico.com/support/soluti…). Re iPad Pro, which now has a USB-C port, "we are still in the process of looking into compatibility and support." 4/
Bummer that Yubico doesn't offer NFC in a USB-C security key. Only in old-style USB-A models. Response: "Finding room for the NFC antenna on the USB-C or nano versions of our YubiKeys is limited, but it's something we're actively working on." 5/
Google uses its own proprietary version of U2F (universal second factor) that pairs password & hardware security key. Only Chrome (and, I believe, Chromium-derived browsers) support it. Google credits hardware keys with immense security improvements. fc16.ifca.ai/preproceedings… 6/
Google is a big believer in hardware-based authentication, crediting it with immense security improvements: cnet.com/news/physical-… Oh, and Google is now selling its own Titan hardware keys: cnet.com/news/google-ma… 7/
Microsoft uses newer FIDO2 standard and its closely related WebAuthn technology for browser support. That enables totally passwordless logon, but Microsoft requires Windows and Edge for now. 8/
There's a risk you'll end up with lots of hardware keys if you embrace this, but newer models (e.g. Yubikey 5 series) can handle U2F and FIDO2 and can span Google, Microsoft, and other hardware key sites. (But no USB-C model w/NFC.) 9/
Microsoft instructions on passwordless logon are here: microsoft.com/en-us/microsof… And Microsoft's promo video on how using all this new technology will make you a happy, smiling, productive person is here: 10/
