Hacker News Reader

Comment by lvh | Hacker News Reader

Because one day we'd like to securely authenticate to things on phones in phone browsers. (I agree that it's not a big a deal as one may think; it only matters if you're logging in to a critical service via the browser and not the app. If you're using the app, it's the app's problem to make sure that you're talking to the Correct Service(TM), so phishing concerns go away.)

View on HN

Contrary to (at least the 4 series-era) Yubico's marketing materials, their Android app works fine with USB (in fact better than with NFC), so if you have and Android phone with a USB-C port, you can plug in a USB-C Yubikey directly (or a USB-A Yubikey with an adapter).

Once browsers on Android support WebAuthn, it may well be that plugging in a USB-C Yubikey will be more convenient than trying to locate the position of the NFC antenna.

Anyone who routinely uses tap-to-pay will already know how to position their phone for NFC functionality. Here in Canada, support for tap-to-pay in point of sale systems is near-ubiquitous. Not 100%, but it's it's very much the exception for it not to be supported.

Financial institution support for phones as the source of the payment tap is spotty here, but definitely growing. Contactless cards are the longer-standing way for Canadians to use this method.

BLE solutions are going to work much better for mobile devices than NFC I think. Google already supports it for their apps via SmartLock and Advanced Protection on both major mobile platforms. Its the browsers, and namely Safari, thats being the blocker on iOS right now - both for NFC and BLE solutions.

It works in iOS Chrome but only on Google properties. I agree Safari is a problem, I’m not sure it’s the only pinch point. They managed to glue it all together with app links and URL schemes.

(Chrome on iOS works fine with Krypton on the same phone, effectively giving me the SEP U2F I want, just with gross UX.)

> BLE solutions are going to work much better for mobile devices than NFC I think

Yubico would disagree. According to their research studies BLE devices are harder to use and less robust.

Source: https://www.yubico.com/2016/06/yubikey-u2f-tracking-bluetoot...

That makes sense. I generally don't use my phone to log into anything that requires 2FA, so that didn't even occur to me. For whatever reason, most of the services I use that require 2FA tend to be pretty useless on mobile web.

Reply on news.ycombinator.com