70 MACWORLD OCTOBER 2019
iOSCENTRAL REVIEW: YUBICO YUBIKEY 5CIto push this substantially more secure
option to iPhones and iPads, by ostensibly
creating demand and interest among
Apple users.
Microsoft Edge, Google Chrome
(desktop and Android), Opera, Firefox
(desktop and Android), and the built-in
Android browser all support WebAuthn in
release versions (go.macworld.com/
wbsp). Apple has enabled WebAuthn in
the Safari Technology Preview (go.
macworld.com/sftp) for the upcoming
version 13, that will ostensibly appear in
release form in Catalina.
Apple hasn’t yet said whether Safari for
iOS and iPadOS will also support
WebAuthn. As a broadly adopted industry
standard that leaves security control in a
user’s hands, there’s little reason for Applecode will always wind up at the
same physical device.
YubiKey currently works
with some apps and via the
Brave browser in iOS. YubiKey
supports the relatively new
WebAuthn protocol (go.
macworld.com/wbat) approved
by the World Web Web
Consortium (W3C) to allow
strong, encrypted second-
factor authentication directly
within a browser, without
requiring proprietary
extensions or company-specific
hardware or software.
The $70 device also includes a USB-C
plug for desktop authentication, but its
USB-C port doesn’t yet work with iPads
equipped with that connector.
In testing, the YubiKey 5Ci performs as
expected, but many websites aren’t yet
ready for iPhone and iPad authentication.
That will change in the near future as
WebAuthn adoption improves and as the
key enters the market.
BROAD INDUSTRY SUPPORT,
BUT SITES BEHIND
Yubico already makes a line of USB and
NFC (contactless) keys that support earlier
secure protocols, while its newer models
also handle WebAuthn. This extension to
Lightning paired with USB-C is an attempt
The YubiKey 5Ci has a LIghtning connector for use on iOS
devices, and a USB-C key for connecting to a Mac. It does
not yet work with USB-C equipped iPads.