YubiKey 5 Series with New NFC and FIDO2 Passwordless Features
I think the YK5&#x27;s biggest problem is that the YK Neo and 4, which have been out for years, were already so good. Unless you really care about NFC at the same time as RSA-4096, I&#x27;m not sure I see a big impetus to upgrade. Hopefully the USB-C line won&#x27;t be plagued with supply issues.<p>WebAuthn is mostly boring and I think that&#x27;s mostly a good thing. I&#x27;m glad that there&#x27;s a way to evolve the spec. Some of the changes are arguably improvements; I could see how Direct Anonymous Attestation is better than the old certificate method. On the other hand, that&#x27;s more exciting crypto than I want to see in W3C specs. But the vast majority of deployments don&#x27;t care about attestation at all: they just care that you can register a specific U2F key once (say, during employee onboarding), and then you never have to care about attestation again. So other than crypto-nerdery, I&#x27;m going to choose not to care much about (EC)DAA.<p>U2F keys already do WebAuthn (individual sites doing bogus feature detection notwithstanding). Despite the name, at the end of the day U2F is just a way to sign some stuff so that it can&#x27;t be replayed and you can&#x27;t get phished. If you really wanted to use it as a single factor, you could.<p>I&#x27;m not sold that the integration of e.g. the browser&#x27;s password manager into WebAuthn is super valuable, but I&#x27;m still happily monitoring what they come up with. That is not a criticism, and certainly not a deprecation. The bottom line is U2F was great, and WebAuthn not convincing me yet is not a good reason to shy away from WebAuthn. WebAuthn is still the best authentication mechanism we (realistically) have by far. Go use it.