Yubico first needed to get Apple's MFi certification-a license required for all Lightning devices-before it could start designing the product and getting third-party developers on board. It's been a long time coming.įirst announced in January, the Lightning YubiKey has been in the works for more than a year now.

But on Tuesday manufacturer Yubico is releasing the first Lightning port YubiKey for use with iPhones and iPads. Unfortunately, to date it's also been unavailable for the most high-profile smartphone in the world. Generally speaking, if users could be expected to use unique passwords, or memorize any secret complex enough to stands up to unmitigated brute-forcing, their product would not need to exist.Though there are other authentication dongles out there, YubiKeys are largely the face of the physical two-factor authentication movement. Yubico is aware of the actual way that passwords are handled by the vast majority of actual users, and how it differs from 'best practice' - in fact, they are well aware of this fact and it forms the basis of advertising physical security keys! So they should know good and well most real-world YubiKeys have the same PIN/password for all functions, and that one brute-forceable function completely nullifies the 8 FIDO tries and 3 PIV tries limit. However, if they offer the feature for added protection, it should at least not reduce protection. I understand OATH-TOTP codes are one factor out of many and are the 'something you have' factor, with 'something you know' being an entirely separate factor, so password protecting this function is not absolutely essential.

Having a function with no attempt limit is bad. Is there any way to set an attempt limit on the password for the OATH-TOTP (Yubico Authenticator) function on the YubiKey 5? Or does it already have a limit, just super high so I've never found it by testing?

1password yubikey