Macworld - USA (2019-10-B)

OCTOBER 2019 MACWORLD 71

to stand aside.
For now, you need the right app in iOS
to work with the YubiKey 5Ci. That
includes the security-minded Brave
browser, which handles WebAuthn directly,
and standalone apps like 1Password and
LastPass that have incorporated support.
Yubico says that more companies are
expected to follow.
I tested the YubiKey 5Ci with Dropbox,
Amazon Web Services console, Twitter,
1Password, and others. Enrollment seemed
to require using a desktop browser at the
moment, and I relied on the USB-C end of
the two-pronged key.
After enrollment, mileage varied.
1Password instantly recognized that I’d
upgraded my authentication, requesting I
insert the key when I launched the app. I
plugged it in via Lightning, tapped it, and
1Password was in business.
Other sites were fussier. Some wouldn’t
recognize the macOS Safari Preview as
supporting WebAuthn, so I switched to
Chrome for the desktop. Then, using the
Brave browser in iOS, some sites refused
to recognize Brave as WebAuthn-
supporting, either. With Dropbox, it
understood the browser could read the
code, but wouldn’t accept it. With Twitter,
however, the system worked as
seamlessly and perfectly as with the
1Password app.
Hundreds of websites already allow

WebAuthn-based logins, which require

very little modification to work alongside

other second-factor methods. The

numbers have increased as browsers

added support for the finished form of the

standard over the last year. But developers

have clearly tried to minimize compatibility

issues by using strict filters about which

browsers it believes are capable.

WebAuthn has the same sort of

advantage over texted and app-generated

second factors as Apple’s Secure Enclave

in iPhones, iPads, and the T2 Security Chip

in Macs—and in similar security chips in

other devices—in requiring possession of

a piece of unique hardware that can’t have

data extracted from it. Instead of relying on

1Password for

iOS knows from

YubiKey. After

upgrading my

account security,

it prompted for

the key the next

time the app was

launched.