Yubico Forum

Hello,
I purchased a YubiKey NEO almost a year ago. I was wondering what the process was to get U2F installed on my NEO?

Thanks

This document describes in detail how to enable U2F on your YubiKey NEO:

https://www.yubico.com/wp-content/uploa ... ey-NEO.pdf

Paraphrased:

You will need to download the YubiKey NEO Manager, found here:

NEO Manager for Windows: http://yubi.co/NEOMgrWin
NEO Manager for OSX: http://yubi.co/NEOMgrMac
NEO Manager for Linux: http://yubi.co/NEOMrgLux

After installing the YubiKey NEO Manager application, run the program as an administrator and click on the "Change connection mode" button. You will need to select U2F here and press "OK." The application will ask you to remove your device and re-insert. At this point, you should be able to test U2F functionality at http://demo.yubico.com/u2f.

Edit: David is correct, I apologize - U2F is only supported on the newer NEO devices.

You will need a YubiKey NEO with firmware version 3.3 or above to support U2F - that firmware was released at the end of September 2014. Older YubiKey NEOs which do not support U2F will be indicated by the NEO Manager tool, and cannot be upgraded to the newer firmware. The firmware of all YubiKeys is locked down to prevent attacks against the YubiKey directly, like the BadUSB attack.

_________________
-David Maples
Yubico Senior Solutions Engineer
http://www.Yubico.com

Tried doing this today but the program never asks me to re-insert the key, and never changes from OTP to U2F. Can't even enable CCIP.

This is on Windows 8-64 btw. Have been unable to build the linux version. It was possible to rename the key though. Made no difference it the program was run as administrator, or in compatibility modes.

Trying to run the linux version, and it complains with:

Managed to get it to change to U2F on windows. Problem was password protected configurations. Removing the protection solved the issue.

You should change so the program informs the user of this limitation, instead of remaining completely silent.

@David, I understand the firmware is locked down to prevent attacks but YubiCo needs to find a better/safer way to get latest firmware (i.e. sending it to you for update) or at least provide other alternatives like discount on new one. You can't expect everyone to throw away the key and buy a new one every time an update to firmware is released, do you?. It is not like it is cheap you can throw it away, I paid $50+10 for my neo (firmware 3.1.2) and I am sure everyone like me who has neo with firmware < 3.3 is pretty mad because we can't use it as a Google Security Key . Please provide us a better alternative instead of simply saying buy a new one --- not a good business model for a hardware vendor!

@aselvan They are happy if you will buy next and next and next key
Of course you're right. Especially that they said that YubiKey is undestructible and may works almost forever.

+1!

Fully understand the security risks, but VERY disappointed that Yubico is NOT providing a reasonable upgrade path for earlier Neo customers. Certainly made me much more skeptical of Yubico's customer support. Glad I'm not the only person who is quite peeved by Yubico's policies in this regard.

What if we mailed in our current/existing Yubikey falvor for a discount? Yubico, the company, can either re-sell them at discounted prices to those that do not want/need updated hardware or destroy them, and we get a discount towards the updated hardware we need? Fair?

~TechStud
Ontario, Canada

If your yubikey has a serial number that has the known management keys (i.e.: the serial number is larger than 3000000 and not between 2624253 to 2624449 and 2624801 to 2625499), I'll buy it from you for the cost of a new yubikey neo.

Send me a PM if you are interested.