Absolutely this. SMS 2FA has security flaws that are becoming ever more evident - U2F via NFC is a great way to authenticate on Android, and I'm looking forward to having it on iOS as well.

Edit: Welp. Looking at the U2F NFC spec it looks like some exchange with the key needs to occur, so without transmit access we're boned.

> U2F via NFC is a great way to authenticate on Android

Unfortunately as far as I know only Yubikey NEO and Fidesmo card support it with Fidesmo being practically not usable. From https://www.fidesmo.com/nfc-u2f-android/ :

> Google’s own account security website, that on desktop allows you to register U2F devices, says that the feature is not compatible with the Chrome browser on Android. The account security site on GitHub seems to support the feature is a bit better. When pressing the button to add a token to the account it properly launches Google Authenticator to register the U2F device. When tapping the card and returning to the GitHub site however it doesn’t seem to have registered that anything has happened.

Sadly there is no NFC token that supports 4096 bit RSA keys (I'm not even talking about EC keys). Fidesmo also has support for PGP/U2F over NFC.

That's okay. RSA-4096 is suitable for long term secrets, but we're talking about authentication: typically signing short challenges, or DH key shares, for immediate verification. The requirements for that application are much lighter.

How do you authenticate through NFC PGP on Android? Is that something specific to your company or is there a public app that you're using?

You can use something called Openkeychain on Android. It uses NFC Yubikeys for both PGP and SSH.

Regarding your 4096 bit requirements, normally when you have those security requirements you would keep that key offline and use shorter lived 2048 bit keys for actual authentication.

There is 4096 bit support with Yubikey 4 which unfortunately isn't offered with NFC.

> You can use something called Openkeychain on Android. It uses NFC Yubikeys for both PGP and SSH.

Okay, but open-keychain does not provide GUI to just sign or authenticate a user (you can sign as part of encryption process) so I was wondering if the parent was mentioning some application that interfaces with open Keychain (like k9mail or conversations.im) that gives just that: user authentication.

> There is 4096 bit support with Yubikey 4 which unfortunately isn't offered with NFC.

Yes, but OTG adapters work pretty well here or one can use Yubikey 4C if the phone has USB-C input.