Hype Will Turn Your Security Key into Junk

Re:Hype Will Turn Your Security Key into Junk by the_snooze on Thursday July 13, 2023 @02:51PM (#36714230)

If you're only using it for two-factor authentication, you don't need a PIN. But when I tried to registered mine as a passkey (passwordless authentication), my browser prompted me for a PIN. I didn't have one set at the time, so it kept rejecting whatever PIN I gave it. I had to use the YubiKey Manager to set a PIN before I could register it as a a passkey.

https://www.yubico.com/support/download/yubikey-manager/

[ Parent | on HN ]

Re:Hype Will Turn Your Security Key into Junk by warp on Thursday July 13, 2023 @04:29PM (#36715532)

You can also manage this from within Chrome (Privacy and security -> Security -> Manage security keys).

[ Parent | on HN ]

Re:Hype Will Turn Your Security Key into Junk by girvo on Thursday July 13, 2023 @08:12PM (#36717818)

I use YubiCo Authenticator for TOTP via my YubiKey, and have a PIN setup due to that. Quite nice really, I imagine it's the same PIN you're talking about? I've not used it as a passkey yet

[ Parent | on HN ]

Re:Hype Will Turn Your Security Key into Junk by dwaite on Thursday July 13, 2023 @09:30PM (#36718365)

Yubico sells Yubikeys where are smartcard devices loaded with several apps (keyboard emulation OTP, GPG, PIV card, and FIDO 2).

They also sell cheaper security keys, which are purpose-built for FIDO 2 only.

When someone says they are using a passkey with a Yubico device, they are talking specifically about the FIDO 2 functionality. This does not (at least currently) support import or export - partially because they want these devices to be sold in regulatory environments where hardware-bound and non-cloneable credentials are required.

[ Parent | on HN ]