I’ve been looking at the Vivokey stuff as I want to get started with getting some implants. I just got a new Yubikey and realized it would be really cool if this was in my hand instead.
It looks like some form factor of the Vivokey is supposed to be able to do this, but I’m not clear on if it requires interaction with the Vivokey specific app.
I’m looking to use it with Google/GMail and LastPass on iOS . Is this something it can currently do or does the U2F - 2FA capabilities require the app?
I did see the other thread where app communications on iOS are still restricted in iOS 13, so I do understand that everything you are trying to do with the Vivokey app can’t be done.
You will be able to store your 2FA keys on the Vivokey Flex. You use the vivokey authenticator app and when a service you are trying to log into asks for your 2FA code ,you scan your tag and the app will give you the code. You can use this with any standard 2FA login. I use it for a bunch of services including in place of the google authenticator app.
Hmmm thanks. Sounds like the crypo/auth is from the Flex to the Vivokey app.
The Vivokey just unlocks the app on the phone providing access to data that is on the phone or transfers the 2FA code from the Flex to the Vivokey app?
Either it doesn’t sound like what I was looking/hoping for
The keys are stored on the flex. I don’t think they keys come off the flex, so they are never sent to the phone, but I’m not 100% sure on that. @amal would have to chime in.
To be clear, it would not read the keys… the card / chip / implant still keeps those internally and performs the crypto internally… the app just acts as an interface.
The OTP applet requires the VivoKey app. We removed some DoS attack vectors from the Yubico master and forked our own version without those vulnerabilities… and so to make it clear and stable, we use our own applet AID and mobile apps for OTP.
The U2F and WebAuthn will be certified standard codebases so it should work as any other contactless U2F / WebAuthn token would work.