I am looking for a way to replace my phone as a 2FA method. U2F is not universally supported. Most services that I use support TOTP (Google Authenticator), and so I thought the Yubikey would support loading the TOTP secret and, upon press of a button, somehow detect the web site I am on, generate the code, and enter it, without additional software involved. Apparently, this does not work. But could it? Or is there hardware that supports this use case?
The hardware token detects the website you're on, generates an appropriate code, and submits it directly without the user typing anything? That sounds a lot like u2f.
The reason why you don't see this offered is the same reason why only a few sites support u2f: it would require the browser to interact directly with the hardware token, and at the moment only Google Chrome is able to connect to USB devices. Other vendors don't see it as an important feature to include. Sad, because it solves phishing more or less entirely.
So no, this doesn't exist as you describe if you're not willing to use u2f. There's stuff like LastPass which can do something of what you ask, but that's a browser extension not a hardware token.
@tylerl is not completely right here. (Especially since U2F requires additional software ;-) The yubikey can work independently of the any driver and any website. So the yubikey will not detect a website, if not in U2F mode.
A full blown yubikey has the following modes:
- AES yubico mode
- Challenge Response (can be used as TOTP)
- Static password
I guess what you are amining at should be HOTP. Which is the event based mode defined in RFC 4226. TOTP is based on HOTP with time being the counter.
You can initialize the yubikey in HOTP mode and write the secret key to the yubikey. The yubikey will then work as a normal keyboard and emit the OTP value whenever you touch the button. Not matter if you are on the right website, in a browser or in notepad. => completely without any additional software and completly without the website caring about you using a yubikey.
I think there are only two challenges here:
The website/application where you want to use this should support HOTP, not only TOTP.
The yubikey only has two slots for this. I.e. you could only use the yubikey with two websites/applications.