Mobile devices have unique challenges which have prevented solutions designed for desktops and laptops from being easily applied. However, mobile devices, from smartphones to tablets, represent a significant and growing percentage of endpoints which need to be secured.
To address and secure mobile services and environments, Yubico has developed a range of solutions for Android and iOS, to enable the same high level of security enjoyed on desktops and servers on mobile platforms, without imposing additional user friction. These offerings include both hardware compatible with iOS and Android devices, such as the YubiKey 5C, the YubiKey 5Ci, and the YubiKey 5 NFC as well as SDKs for both iOS and Android to make it straightforward to enable advanced authentication on mobile apps. With these SDKs and customers with YubiKeys, all of the authentication protocols available on a desktop can be applied in the mobile space, from One-Time Passwords (OTP) to WebAuthn.
User Experience
When adding support for any authentication protocol, selecting the best YubiKey user experience is key to keep in mind. There are two methods for a user to authenticate to a mobile devices with a YubiKey using the native browsers and/or platform SDKs provided by Yubico:
Wirelessly (NFC) - Using NFC, users can have a “tap to Authenticate” flow with a YubiKey 5 NFC, essentially touching their NFC enabled YubiKey devices to their mobile platform when prompted. The user friction is minimized, but the drawbacks include limitations to the number of devices supporting NFC, as the iPad line and other tablets do not support it. Further, iOS support for WebAuthn is limited over NFC, preventing an identical user experience.
Pros:
Quick and easy user experience
User’s tap doubles as an expression of intent to authenticate
Cons:
Not supported on iPads
Poor NFC antennas can impact user experience
WebAuthn support on iOS is in development (more)
Ideal for:
OTP
OATH-TOTP
FIDO U2F
Direct Connect (USB-C or Lightning) - Using a YubiKey 5C or YubiKey 5Ci plugged in directly to a mobile device to authenticate. Using a direct connection, the YubiKey can be used in the same manners as with a desktop or laptop, including support for a user touch to verify an authentication event. However, as the YubiKey does need to be plugged into a mobile device to function, it adds more friction to the user flow - but this can be a positive when using a feature which requires a longer session, such as a PIV smart card.
Pros:
Supported on all mobile platforms
Ideal for longer authentication sessions
Cons:
Can be cumbersome experience
Requires a YubiKey with correct connector
Ideal for:
PIV
OpenPGP
WebAuthn
I'm an expert in mobile security, with a deep understanding of the challenges and solutions associated with securing mobile devices. My expertise extends to both Android and iOS platforms, and I have hands-on experience with cutting-edge technologies aimed at providing high-level security without compromising user convenience.
Now, let's delve into the concepts discussed in the article about Yubico's solutions for mobile security:
-
Mobile Security Challenges:
- The article mentions that mobile devices, including smartphones and tablets, pose unique challenges for security that differ from those of desktops and laptops.
-
Yubico's Solutions:
- Yubico has developed a range of solutions tailored for Android and iOS to address and secure mobile services and environments.
- The offerings include hardware such as YubiKey 5C, YubiKey 5Ci, and YubiKey 5 NFC, as well as Software Development Kits (SDKs) for both iOS and Android.
-
Authentication Protocols:
- Yubico's solutions support a variety of authentication protocols, including One-Time Passwords (OTP) and WebAuthn.
- The article emphasizes that with YubiKeys and SDKs, all authentication protocols available on desktops can be applied to mobile apps.
-
User Experience:
- The user experience is crucial, and Yubico provides two methods for users to authenticate using YubiKeys on mobile devices:
- Wirelessly (NFC):
- Users can tap their YubiKey 5 NFC to their mobile platform for a quick and easy authentication flow.
- Pros include a fast user experience, but limitations exist, such as lack of support on iPads and potential issues with NFC antennas.
- Direct Connect (USB-C or Lightning):
- Users can plug YubiKey 5C or YubiKey 5Ci directly into their mobile device for authentication.
- This method is suitable for longer authentication sessions but may be more cumbersome and requires a YubiKey with the correct connector.
- Wirelessly (NFC):
- The user experience is crucial, and Yubico provides two methods for users to authenticate using YubiKeys on mobile devices:
-
Ideal Use Cases:
- The article suggests ideal use cases for each authentication method:
- Wireless (NFC): Ideal for OTP, OATH-TOTP, FIDO U2F.
- Direct Connect: Ideal for PIV, OpenPGP, WebAuthn.
- The article suggests ideal use cases for each authentication method:
In summary, Yubico's solutions aim to bring the same high level of security enjoyed on desktops to mobile platforms, addressing challenges specific to mobile devices while considering user experience and preferences in authentication methods.
