Yubi Security Key (aka Blue Key) Work for Miva 2FA ?

[Bruce - PhosphorMedia]

Does this mean the Yubi Security key (aka Blue Key) now works for 2FA in Miva? Client needs to purchase about 10 and would appreciate the cost savings.

28756: Administrative Interface: YubiKey 5 and blue Security Key by Yubico do not work in WebAuthn mode

[ILoveHostasaurus]

Latest release does support WebAuthn, which the security key supports, so that should work. Keep in mind that the Yubi Security Key is missing other features, which basically relegates it to just a web app access key. The more expensive ones can also do things like double as smart cards to permit 2fa logins to desktop computers, storing PGP / SSH keys, etc. so they may be able to play a much greater role in overall desktop security at a given business, which may not be high on the list right now, but could in the future.

[wajake41]

Yubikey 4 given with a subscription to Wired magazine can be purchased on ebay for $15 -30 dollars, I'm using one that I purchased there for Miva 2fa.

[Eric Foresman]

Does this mean the Yubi Security key (aka Blue Key) now works for 2FA in Miva? Client needs to purchase about 10 and would appreciate the cost savings.

28756: Administrative Interface: YubiKey 5 and blue Security Key by Yubico do not work in WebAuthn mode

Hi Bruce

With the release of mm9.12.00 the Yubi Security key (the blue one), YubiKey 5, YubiKey 4 have all been tested and work. Please keep in mind when using the Yubi Security key (the blue one) that it will only support WebAuthn which means you will be limiting the user to browsers that support WebAuthn (currently only FireFox and Chrome).

Hope this helps
-Eric

[lesliekirk]

Coming back to an old post because I'd like to recommend Yubikey to a client. I bought a Yubico - YubiKey 4 - USB-A when David recommended it. Whats the recommended "version" for use with a Miva admin? I might even want to update too.

[ILoveHostasaurus]

I believe the blue key was their "Security Key" product line, even though it's now black like the rest. It will work with a Miva Merchant store in Webauthn mode. It will not work in YubiOTP mode. Webauthn is the ideal option regardless, because that does not require the call out to Yubi (who could be down), and it is specific to the domain being authenticated on.

That being said, for the $25 difference in price, the Yubikey 5 is much more flexible because it does support other methods and increased functionality (storing of encryption keys, etc.). Those may be useful to some types of users, now or in the future; for example, storing an SSH key in one for use with Miva's command line tools.