YubiKey Gains iOS SDK to Enable Secure 2FA Logins in Select Apps Using NFC

by

Yubico is a company that sells the "YubiKey," a small piece of hardware that protects access to computers and online accounts by providing strong two-factor authentication in lieu of receiving a text message code on a smartphone or other 2FA steps. With the NFC-equipped YubiKey NEO, Android users have been able to authenticate their log-ins with a tap, and this week Yubico announced that ability has launched for iPhone users as well (via The Next Web).


With the launch of the YubiKit 1.0.0 iOS SDK, the company is allowing developers to add support for the YubiKey NEO into their iOS apps, starting with sole support from LastPass. Once set up with a LastPass account, the YubiKey NEO generates a one-time password, and when the user gets to the 2FA log-in screen, they simply tap the NEO near the back of the iPhone to authenticate.

It has been possible for developers to integrate with YubiKey NEO since iOS 11 launched in September, but the debut of the SDK should lead to wider adoption since it will be far easier for developers to introduce support for the device's NFC abilities.

The NEO does not require a battery to function, nor does it need network connectivity, and Yubico says that it is "four times faster" than typing a traditional one-time passcode. In addition to NFC, the device has a dongle for USB-A connectivity so it can double as an authenticator on laptop and desktop computers, and Yubico says that it's crush resistant and waterproof.


The YubiKey NEO is supported on iPhone 7 devices and newer, and for LastPass the feature is supported under the Premium, Families, Teams, and Enterprise subscription tiers. Yubico hasn't yet revealed which apps might next launch support for the YubiKey NEO on iOS devices. YubiKey can already securely log users in on macOS 10.12 or later, and the product integrates with hundreds of services and applications online.

Those interested can purchase the YubiKey NEO from the company's website for $50.

Top Rated Comments

(View all)
Avatar
32 months ago
Just doesn't work with enough services I actually use. At a minimum amazon needs to support it. And of course more online stores and services.
Score: 1 Votes (Like | Disagree)
Avatar
32 months ago

The Yubikey can implement multiple schemes. One protocol here is called Yubico OTP. This is a Yubico proprietary HOTP-like scheme, and relies on a shared secret held by Yubico. It is a one-way protocol, which means that it can be handled via iOS's read-only NFC support. It is broadly similar to OATH HOTP, but again, to eliminate provisioning, it, by default, relies on a shared secret installed and held by Yubico and their verification servers. (You can overwrite this with a custom server and verify yourself). The major weakness of this scheme is that it is not resistant to man-in-the-middle attacks.

OATH HOTP is a second option. That is the event-based Authly/Google Authenticator. It requires individual provisioning, does not require a trusted third-party, but does nothing to protect against MITM.

The Yubikey can also implement U2F, which does protect against man-in-the-middle attacks. However, U2F requires two-way communication with the fob, which cannot be done with the current NFC framework in iOS. The solution is that there are a number of BLE U2F tokens, which do work with iOS.

In my opinion, because Yubico OTP is obsolete. It relies on Yubico's servers and secrets and does not protect against MITM like U2F does. It is similar to other services now gone (Symantec VIP).

konqerror, you analysis is SPOT ON! YubiOTP is still a "shared secret" solution. Yubico has taken the shared secret model about as far his it can. It's really a combination of both HOTP and TOTP, there is a counter element and a time element, as well as some other data that is incorporated into the OTP that is genereated. Self Hosted OTP validation server is rather easy, that's what I do at home.

Completely agree that U2F is much better. It's a modern, asymmetric encryption solution. Unfortunately, it only works with web based services today, and requires a web browser that understands U2F. Currently only Chrome and Firefox. FIDO2 should remove these limitations and open up this functionality to not web services. I am looking forward to having FIDO 2 support for everything!

I also hope that Apple will open up the NFC interface to third party developers soon. That would be a great win for ALL customers.

I have looked at the BLE stuff. Still not as easy to use as the Yubikey. Requires a battery, and are considerably thicker that the Yubikey. I still have my original Yubikey I purchased in 2009. Still works, even after being washed at least twice.
Score: 1 Votes (Like | Disagree)
Avatar
32 months ago



Absolutely! That is a big issue. I request Yubikey support for every service I use. Have been asking my bank for YK support for many years. I finally got some traction over the last few months. Let's see what happens...

I have actually been successful in some cases with the requests. Many times, it's just that the services does not know about the Yubikey value. I have and conversations with a number of services and discuss this topic. Not all are open to the idea, but some are.

That's a good idea. I'll get a hold of my credit union. They seem very interested in adopting new technologies. Even though yubikey isn't new.
I'm surprised Chase isn't on the list. Or other major banks.
Score: 1 Votes (Like | Disagree)
Avatar
32 months ago

Never heard of YubiKey before, and since reading this I’ve done a little research. I have been using Authy up until this point, which I only have running on my iPhone (and not the chrome extension on macOS, as an example).

Is YubiKey far more secure than Authy? What are folks personal experience with using YubiKey on various websites? Have you completely replaced an authenticator app with YubiKey?

Also, does YubiKey work with Brave browser on macOS? I’ve seen reviews where it only works on Chrome, yet I’ve seen it mentioned on GitHub it has been in development for a couple years now.

In my opinion, yes the Yubikey is more secure. First, it's an external hardware token with a cryptographic engine on it. Authy (and Google authenticator, as well as others) use a "shared secret" That means that the web site you log into has your shared secret. If that is compromised, then all bets are of. Yubikey uses U2F, which is a public/private key solution. The web site does NOT have the secret key, only the public key. Even if they get your public key, a hacker cannot log in without your private key.

The YK also standard standardOTP (similar to Authy), as well as an enhanced Yubico OTP. As long as the web site supports Yubico OTP or U2F, you are good. OTP is independent of the web browser, it is based in the web site. U2F does require a compatible browser. Right now Chrome and Firefox are the only ones to support it. Hopefully Safari will be coming soon. MS will provide Edge support soon also.
Score: 1 Votes (Like | Disagree)

Top Stories

Apple References Unreleased 2020 16-Inch MacBook Pro in Boot Camp Update

Monday October 26, 2020 8:42 am PDT by
Last week, Apple released an update for Boot Camp, its utility for running Windows on a Mac. While this update would typically be unremarkable, several of our readers noticed that the release notes reference an unreleased 2020 model of the 16-inch MacBook Pro. While this could easily be a mistake, the 16-inch MacBook Pro is nearly a year old, so it is certainly a worthy candidate for a...

MagSafe Charger Only Charges at Full 15W Speeds With Apple's 20W Power Adapter [Updated]

Monday October 26, 2020 3:38 pm PDT by
Alongside the iPhone 12 and 12 Pro models, Apple introduced a new MagSafe charger that attaches to the magnetic ring in the back of the devices, providing up to 15W of charging power, which is double the speed of the 7.5W Qi-based wireless charging maximum. Apple does not provide a power adapter with the $39 MagSafe charger, requiring users to supply their own USB-C compatible option. Apple...

Google Reportedly Pays Apple $8-12 Billion Per Year to be Default iOS Search Engine

Sunday October 25, 2020 2:59 pm PDT by
The United States Justice Department is targeting a lucrative deal between Apple and Google as part of one of the U.S. government's largest antitrust cases, reports The New York Times. On Tuesday, the Justice Department filed an antitrust lawsuit against Google, claiming the Mountain View-based company used anticompetitive and exclusionary practices in the search and advertising markets to ...

After Mocking Apple, Samsung May Remove Power Adapter From Galaxy S21 Box

Tuesday October 27, 2020 4:29 pm PDT by
Samsung's Galaxy S21, coming in 2021, may not include a power adapter or headphones in the box, according to reports from Korean media sites highlighted by SamMobile. Rumors earlier this year also said that Samsung was considering removing these accessories from future smartphone models, but that didn't stop Samsung from mocking Apple for selling the iPhone 12 models without a power adapter...

Report: Apple Silicon iMac Featuring Desktop Class 'A14T' Chip Coming First Half of 2021

Tuesday October 27, 2020 4:14 am PDT by
The first iMac powered by Apple Silicon is set to arrive in the first half of next year and will feature a desktop class "A14T" chip, according to Chinese-language newspaper The China Times. Codenamed "Mt. Jade," Apple's first custom-made desktop processor will be twinned with its first self-developed GPU, codenamed "Lifuka," both of which are being produced using TSMC's 5-nanometer process, ...

iPhone 12 Six-Foot Drop Test Results: Ceramic Shield More Durable But Not Damage Proof

Monday October 26, 2020 5:00 am PDT by
Apple's new iPhone 12 and iPhone 12 Pro feature a new Ceramic Shield screen that Apple says offers 4x better drop performance. To test that claim, Allstate Protection Plans put the two models through a range of breakability tests and recorded the results. In a face down sidewalk drop test at six feet, the iPhone 12 suffered small cracks and scuffed corners and edges, leaving sharp grooves in ...

Bloomberg: New AirPods and AirPods Pro Coming in 2021, AirPods Studio Delayed, Third HomePod Model Also Possible

Monday October 26, 2020 3:34 am PDT by
Apple plans to update its AirPods line next year with two new models including third-generation AirPods and second-generation AirPods Pro, according to a new report from Bloomberg. The Cupertino, California-based technology giant is working on two new models: third-generation entry-level AirPods and the second version of the AirPods Pro earbuds, according to people familiar with the plans. ...

2020 iPad Air vs. iPad Pro: Hands-On Comparison

Tuesday October 27, 2020 3:03 pm PDT by
Apple announced the new 2020 fourth-generation iPad Air in September, but the new tablets just started shipping out to customers last Friday. We picked one up and thought we'd do a hands-on comparison with the iPad Pro, which was last updated in March, because both tablets are about as powerful and share many similarities. Subscribe to the MacRumors YouTube channel for more videos. Design and ...

iPhone 12 Ceramic Shield Still 'Scratches at Level 6 With Deeper Grooves at Level 7' in Mohs Hardness Test

Wednesday October 28, 2020 7:10 am PDT by
iPhone 12 and iPhone 12 Pro models feature a new Ceramic Shield front cover that is "tougher than any smartphone glass," according to Apple, but the displays on the devices still have similar scratch resistance as previous iPhones based on a new test. Zack Nelson today shared his much-anticipated iPhone 12 Pro durability test on his YouTube channel JerryRigEverything, and based on the Mohs...

Apple Files Mystery 'Personal Computer' With Placeholder 'B2002' Name in Bluetooth Product Database

Tuesday October 27, 2020 12:36 pm PDT by
Last week, a listing appeared in the Bluetooth product database for an Apple product with a placeholder name "B2002" and a model number of "TBD." MacRumors was alerted to the listing by health and fitness tech website MyHealthyApple. The product is filed under the "personal computer" category, which Apple has used for previous Mac and iPad listings in the database, so it is hard to pinpoint...