Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Safari Supports NFC, USB, and Lightning FIDO2-Compliant Security Keys in iOS 13.3

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
68,763
39,715



The iOS 13.3 update that is currently available to developers and public beta testers has a new Safari feature that supports NFC, USB, and Lightning FIDO2-compliant security keys.

This option was activated in the first beta of iOS 13.3, but in the second developer beta, Apple has added details about it in the release notes.

yubico1-800x533.jpg
Now supports NFC, USB, and Lightning FIDO2-compliant security keys in Safari, SFSafariViewController, and ASWebAuthenticationSession using the WebAuthn standard, on devices with the necessary hardware capabilities.
Click to expand...
With the iOS 13.3 update, Safari will support physical security keys like the Lightning-equipped YubiKey, which can be used for more secure two-factor authentication.

Yubico announced the YubiKey 5Ci back in August, but at the time of launch, it was of limited usefulness because it did not work with Safari, Chrome, or other major browsers, though it was compatible with apps like 1Password.

With Safari support, the YubiKey 5Ci is a legitimately useful tool that can be more convenient than software-based two-factor authentication because there's no need to enter a security code -- you simply plug it in to an iPhone or Mac (there's also a USB-C connector) to authenticate. Support for FIDO2-compliant USB security keys using WebAuthn was previously added to Safari 13 in macOS.

Other NFC, USB, and Lightning-based security keys will also work with Safari following the iOS 13.3 update. There's no word yet on when iOS 13.3 will be released, but we may see it sometime in December after a few more weeks of beta testing.

Article Link: Safari Supports NFC, USB, and Lightning FIDO2-Compliant Security Keys in iOS 13.3
 
Article Link
https://www.macrumors.com/2019/11/12/ios-13-3-fido2-security-key-support-safari/
  • Like
Reactions: mainemini
FIDO is that wonky thing where where the site is what is actually storying your keypair, but with you having locally encrypted it so it can give it to you so you can decrypt it so you can use that to verify the public half of the keypair that the site is also keeping?

Security Now! Transcript of Episode #445

www.grc.com

Should just do something sensible like SQRL, or really any other solution.
 
  • Like
Reactions: CarlJ
This should open the door for Trezor users. A better implementation over Yubi IMHO in case you lose your key.
 
macsimcon said:
So...when can we expect this for Safari in Catalina?
Click to expand...
You might want to read more carefully: "With Safari support, the YubiKey 5Ci is a legitimately useful tool that can be more convenient than software-based two-factor authentication because there's no need to enter a security code -- you simply plug it in to an iPhone or Mac (there's also a USB-C connector) to authenticate. Support for FIDO2-compliant USB security keys using WebAuthn was previously added to Safari 13 in macOS."
 
This is some great news that is highly underrated. This gets us a lot closer to getting rid of the stupid password-based approach.
Besides that: A lot of countries have developed NFC capable ID cards that can now be put to work...
And, no, since those cards don't hand out the private key, this will not lead to more identity theft. In fact, it will help fight it.
andywaynebrooks said:
This is great news for the 8 people who will ever use this totally obscure feature.
Click to expand...
Unless you want everyone "sign-in with Apple" (or google) and so on, this is the only secure and easy to use approach to passwordless login...
 
  • Like
Reactions: mainemini
andywaynebrooks said:
This is great news for the 8 people who will ever use this totally obscure feature.
Click to expand...

Willing to bet you will eat these words by this time next year.

All our security standards are extremely weak and / or have been hacked so we need new ones desperately. 2FA is going to be the savior of doing anything wallet related on your computer.

The reason this is fantastic news is that it will allow mass adoption of way better, way more convenient, way more mass compatible security.
 
  • Like
Reactions: Tenpoundhero and ksnell
andywaynebrooks said:
This is great news for the 8 people who will ever use this totally obscure feature.
Click to expand...

And notice how devoid of the usual comments ("about time!", "what could go wrong", "how about you fix your software, Tim.", "X dollars? that's insane!", "insert dad joke here") this thread is. People are more likely to complain about what they don't quite fully understand but not about what they know nothing about IMHO.
 
  • Like
Reactions: haruhiko
robbysibrahim said:
And notice how devoid of the usual comments ("about time!", "what could go wrong", "how about you fix your software, Tim.", "X dollars? that's insane!", "insert dad joke here") this thread is. People are more likely to complain about what they don't quite fully understand but not about what they know nothing about IMHO.
Click to expand...
Hard to put a double standard on when you don't know what your supposed to hate about, I guess.
 
  • Like
Reactions: haruhiko
Not exactly. The important thing is that it's a key *pair*.

The site stores the public half of the key, no need to encrypt it at all, that's ltierally why we call it public. Share it with as many people as you like, and security is not compromised. The FIDO device securely stores the *private* part. Securely in this sense meaning when you plug into a device like a phone or a computer, the key doesn't leave the device. This is very good because you don't need to trust the device you're plugging into. Public computers, even your phone itself getting compromised, are way less of a problem than they would otherwise be.

I'm not deeply familiar with SQRL, but basically, it is not an alternative to a device like this, but a potential complement to it. SQRL is more an alternative to passwords and a solution to password managers. Like FIDO, SQRL also uses a keypair, from what I understand that's the main benefit. Because keys are *public* if a website gets hacked, there are no passwords to dump, just public keys. Strong 2FA is still useful, and is not part of the protocol (as far as I'm aware.)

axcess99 said:
FIDO is that wonky thing where where the site is what is actually storying your keypair, but with you having locally encrypted it so it can give it to you so you can decrypt it so you can use that to verify the public half of the keypair that the site is also keeping?

Security Now! Transcript of Episode #445

www.grc.com

Should just do something sensible like SQRL, or really any other solution.
Click to expand...
 
Wonder if this ties in with Apple Tags thing to locate missing keys, or if the Apple Tags itself has a private key usable as authentication..
 
axcess99 said:
FIDO is that wonky thing where where the site is what is actually storying your keypair, but with you having locally encrypted it so it can give it to you so you can decrypt it so you can use that to verify the public half of the keypair that the site is also keeping?

Security Now! Transcript of Episode #445

www.grc.com

Should just do something sensible like SQRL, or really any other solution.
Click to expand...
I wish you Steve Gibson sycophants would give it a rest. FIDO2 is a robust authentication system which has already been fully vetted and ratified by the W3C, and also adopted by every major web browser. They aren't going to roll everything back to allow some win32 binary to authenticate a user. Hardware/biometric authentication is the future for passwordless authentication.
 
axcess99 said:
FIDO is that wonky thing where where the site is what is actually storying your keypair, but with you having locally encrypted it so it can give it to you so you can decrypt it so you can use that to verify the public half of the keypair that the site is also keeping?

Security Now! Transcript of Episode #445

www.grc.com

Should just do something sensible like SQRL, or really any other solution.
Click to expand...

Seriously, Gibson is a hack and a charlatan, no one serious in the industry respects him. There were several sites that debunk what he spewed, but they just stopped being maintained over 15 years ago because there was already too much information. Gibson total made things up (Socketgate?).

U2F which FIDO2 is based off of is well reviewed, and now included in the W3C specification through WebAuthN.
 
  • Like
Reactions: bkaus
bkaus said:
So, does it make sense to get a lightning based one? Or the NFC?
Click to expand...
I think the NFC one will last longer on more devices. Lightning port is already being removed on Apple devices. USB C will eventually be replaced too. NFC will stay around longer and will work on your next 4 iphones before it breaks.
 
Anon Ymous said:
I think the NFC one will last longer on more devices. Lightning port is already being removed on Apple devices. USB C will eventually be replaced too. NFC will stay around longer and will work on your next 4 iphones before it breaks.
Click to expand...

thanks. I did contact yubico and they said the NFC one doesn’t support all the protocols.

I’ll probably wait out one more found. But all the web extensions are great!
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back