China is a lovely country filled with awesome people.

For a key that's to be used for mobile, it's definitely needed.Ī final bit of contention is the origin of manufacture. On the other hand, Bluetooth support is a must if you want to use a security key with iOS. Bluetooth could be compromised by a MiTM attack that could get the session token, but the attacker would need to be right beside you. Right now this only works for Google sites and services, but it's foolproof.īluetooth support is important but can be a security risk as Yubico is quick to point out. This makes sure that you're really logging into the page you think you're logging into. Using the FIDO2 standard to prevent MiTM ( Man in The Middle) attacks and password phishing, the Titan firmware also allows the URL of the requesting page to be sent along with the request. Google does things differently, as they are prone to doing. There are many companies working with the FIDO Alliance to push FIDO2 adoption, and it's a thing you should want. These credentials cannot be reused, replayed, or shared across services, and are not subject to phishing and MiTM attacks or server breaches.įIDO2 is the future and will one day, hopefully, make a username and password obsolete. With these new capabilities, the YubiKey can entirely replace weak static username/password credentials with strong hardware-backed public/private-key credentials. You can read more about FIDO and FIDO2 here, but according to Yubico - a core contributor to FIDO2 - here's the jist of it:įIDO2 offers expanded authentication options including strong single factor (passwordless), strong two factor, and multi-factor authentication.

FIDO2 is a new standard that offers the same secure 2FA capabilities we're used to seeing with the original FIDO ( Fast IDentity Online) standard.

Google security key