Yubico, a company that sells physical security keys for two-factor authentication, today announced the launch of the new YubiKey 5C NFC, pairing USB-C and NFC support in a single device.
According to Yubico, the YubiKey 5C NFC is the first multi-protocol security key that supports smart cards. With the NFC integration, the YubiKey 5C NFC features tap-and-go authentication that works with all major browsers and operating systems, plus it continues to offer a physical USB-C connector.
Like other devices in the YubiKey lineup, the YubiKey 5C NFC is a hardware-based two-factor authentication dongle that is designed to work with hundreds of services to make logins more secure. It's more convenient than software-based two-factor authentication because you don't need a security code. Just connect it to a USB-C device or tap it on an NFC-compatible iPhone to authenticate.
"The way that people work and go online is vastly different today than it was a few years ago, and especially within the last several months," said Guido Appenzeller, Chief Product Officer, Yubico. "Users are no longer tied to just one device or service, nor do they want to be. That's why the YubiKey 5C NFC is one of our most sought-after security keys -- it's compatible with a majority of modern-day computers and mobile phones and works well across a range of legacy and modern applications. At the end of the day, our customers crave security that 'just works' no matter what."
YubiKey 5C NFC is compatible with common password management apps like 1Password and LastPass, and it also works on the web. It supports multiple authentication protocols such as FIDO2 and WebAuthn, FIDO U2F, PIV (smart card), OATH-HOTP and OATH-TOTP (hash-based and time-based one-time passwords), OpenPGP, YubiOTP, and challenge-response, so a single key can work with multiple services and applications.
We used Yubikeys in our org up through last year. They’re $50+ per piece. Our security team doesn’t allow us to deprovision/reprovision them for a 2nd use once they’ve been issued to the first departing employee because they could then contain malware and be compromised- even after following Yubi’s procedures to scrub them.
Needless to say, we don’t use them anymore because if you can’t safely repurpose an IT asset during its service life, it’s a showstopper.
If whatever you're trying to protect isn't worth 50 USD per employee why bother with the yubikeys in the first place? In most organisations I've worked getting a new employee hired, onboarded and trained up is costed in thousands of dollars at a minimum, 50 USD is insignificant compared to that cost, and items under 75 USD aren't tracked on our asset register.
We used Yubikeys in our org up through last year. They’re $50+ per piece. Our security team doesn’t allow us to deprovision/reprovision them for a 2nd use once they’ve been issued to the first departing employee because they could then contain malware and be compromised- even after following Yubi’s procedures to scrub them.
Needless to say, we don’t use them anymore because if you can’t safely repurpose an IT asset during its service life, it’s a showstopper.
Then I have to say as a fellow tinfoil-hat wearer that your security team is really not smart, or really doesn't understand the YubiKey.
It is not possible* for someone to alter the code on a YubiKey once it has been programmed and sealed at the factory.
To me this would be a whistleblower moment for higher-ups. They are throwing away both a massive capital investment, and quite literally (when used properly) the best tool they have against both phishing and lateral movement in their network, because they fail to adequately understand what they are working with and do a proper risk assessment.
Stories like this anger me so much. We need the best security we can possibly get, especially in an age where so many peoples' personal data is being collected and stored. But no, instead of asking the right questions, doing proper research, and doing a proper risk analysis, we're going to use something inferior.
(*as with anything else, yes, I'm sure it's possible somehow, but 1. not by persons of ordinary means and 2. not without physical destruction of the device or other evidence of tampering. Your security team is flushing value down the toilet over the smallest possible chance of compromise.)
I tell people that I use the last 6 digits of pi. With the people I used to hang around with, that usually got a few chuckles, and a puzzled look for whomever I was telling it to. So anyway...
Wednesday April 21, 2021 12:43 am PDT by Tim Hardwick
Apple's AirTag tracking devices can be identified by Android phones when they're in Lost Mode, according to a new support document published by Apple.
Announced on Tuesday, Apple's new AirTag item trackers let you easily track things like your keys, wallet, purse, backpack, luggage, and more. They work using an ultra-wideband U1 chip to keep in touch with the Find My network. However,...
Nomad today announced the launch of the Base Station Mini, a new single-device charging option that's designed to power an iPhone, AirPods, or other Qi-enabled device.
Designed to take up little space, Nomad says that the Base Station Mini is ideal for a night stand or desk. It's square shaped and not too much bigger than the AirPods, so it's useful for those who want a simple, space-saving...
Satechi, known for its lineup of accessories designed for Apple's Macs, today announced the launch of the USB-C On-the-Go Multiport Adapter that's compatible with the Mac lineup and the iPad Air and iPad Pro.
With the USB-C On-the-Go Multiport Adapter, Satechi aimed to fit in as many ports as possible into a package that's still portable. It includes a built-in USB-C PD charging port that...
AgileBits has released a version of 1Password for web browsers that brings Touch ID integration to the popular password management service.
The addition of support for biometric authentication means that if 1Password is locked and you have the desktop app installed, you can use the Touch ID ring that comes with Apple's latest MacBooks and Magic Keyboards to unlock your passwords.
The...
Popular Mac accessory makers CalDigit and OWC have today announced new all-in-one Thunderbolt 4 and USB 4 cables, promising maximum data and power transfer over a single cable, as well as full compatibility with older USB devices.
Thunderbolt 4 and USB 4 is the latest connectivity specification present in the newest Macs and high-end external hardware, offering performance up to 40Gb/s,...
The AirTag's built-in NFC coil can be used by the Apple Shortcuts app to trigger automations, it has been found.
The functionality, noticed by iCulture, allows users to trigger Shortcuts by simply tapping the top of their iPhone on the white plastic side of the AirTag. As Shortcuts are completely user-configurable, and can be used to initiate an almost infinite number of actions, the fact...
Apple's upcoming MacBook Pro models are expected to feature a number of major changes such as larger display options and powerful new Apple silicon chips. Among the more surprising updates to this year's MacBook Pro models is the return of three ports that have been missing from the machines for over five years.
Expected to come in 14- and 16-inch sizes, the 2021 MacBook Pro models are...
The Connectivity Standards Alliance, which includes major tech companies like Apple, Amazon, and Google, today announced the launch of "Matter," a new interoperable, secure connectivity standard designed for smart home devices.
Formerly known as "Project CHIP," Matter is a unified IP-based connectivity protocol that will be used to build and connect Internet of Things ecosystems. It is...
Continuing the tradition set with the iPhone 13 Pro, only the highest-end iPhone 14 models will feature Apple's ProMotion display technology, according to a respected display analyst.
Ross Young, who on multiple occasions has detailed accurate information about Apple's future products, said in a tweet that ProMotion will not be expanded to the entire iPhone 14 lineup and will remain...
Sunday January 16, 2022 3:37 pm PST by Joe Rossignol
A bug in WebKit's implementation of a JavaScript API called IndexedDB can reveal your recent browsing history and even your identity, according to a blog post shared on Friday by browser fingerprinting service FingerprintJS.
In a nutshell, the bug allows any website that uses IndexedDB to access the names of IndexedDB databases generated by other websites during a user's browsing session....
Saturday January 15, 2022 8:05 pm PST by Joe Rossignol
Apple is planning to release a fifth-generation iPad Air with similar features as the sixth-generation iPad mini, including an A15 Bionic chip, 12-megapixel Ultra Wide front camera with Center Stage support, 5G for cellular models, and Quad-LED True Tone flash, according to Japanese blog Mac Otakara.
Citing reliables sources in China, the report claims that the new iPad Air could be...
Saturday January 15, 2022 2:06 pm PST by Tim Hardwick
Much has been said about what consumers could see from Apple in 2022, but the company is also working on a handful of rumored products that aren't expected to be unveiled for at least another 12 months, and in some cases a lot longer. Of course, that's assuming they get released at all. Apple works on many potential products some of which ultimately never see the light of day. With that in...
Apple's second-generation AirPods Pro could arrive alongside a new series of accessories, recent leaked images suggest.
Alleged leaked photos of the next-generation AirPods Pro obtained by MacRumors showed a charging case with a metal loop on the side for attaching a strap. Apple has not used this design for any of its other AirPod models and it is unclear why it would be added in this...
Friday January 14, 2022 12:46 pm PST by Juli Clover
Netflix today updated the prices for its streaming plans, and all of its offerings are now more expensive. The Basic plan is now priced at $9.99 per month, the Standard plan is priced at $15.49 per month, and the Premium plan is priced at $19.99 per month.
The Basic plan is $1 more expensive, up from $8.99 per month. This plan allows users to watch on just one screen at a time, and it limits ...
A Tesla Model 3 owner has resorted to a workaround to implement Apple CarPlay in his vehicle, amid no sign of official support from Tesla (via Tesla North).
Apple CarPlay and Apple Music support are among the most-requested Tesla features, but with no indication that Tesla is willing to implement Apple CarPlay in its vehicles, Polish developer Michał Gapiński took matters into his own...
Hole-punch? Pill? Hole-punch and pill? Rumors about what the front camera system on the iPhone 14 Pro will look like are evolving rapidly, and it now appears we might be getting a novel but potentially controversial design later this year.
Other major stories this week included some confusion and controversy about iCloud Private Relay being disabled for some T-Mobile customers, increasing...
Top Rated Comments
Did you find something that's better/cheaper?
It is not possible* for someone to alter the code on a YubiKey once it has been programmed and sealed at the factory.
To me this would be a whistleblower moment for higher-ups. They are throwing away both a massive capital investment, and quite literally (when used properly) the best tool they have against both phishing and lateral movement in their network, because they fail to adequately understand what they are working with and do a proper risk assessment.
Stories like this anger me so much. We need the best security we can possibly get, especially in an age where so many peoples' personal data is being collected and stored. But no, instead of asking the right questions, doing proper research, and doing a proper risk analysis, we're going to use something inferior.
(*as with anything else, yes, I'm sure it's possible somehow, but 1. not by persons of ordinary means and 2. not without physical destruction of the device or other evidence of tampering. Your security team is flushing value down the toilet over the smallest possible chance of compromise.)