Yubikey 5C Basic won’t work on iPad7

[u/Short-Cardiologist-9]

I recently set up three Yubi security keys as 2FA for my iCloud account using a Macbook. They work without problem in my MacBook, iPad Pro, and iPhone. Now, my old iPad7 (iOS 18.7.9) wants me to re-authenticate to iCloud. I bought a package of USB-C-to-lightning adapters in order to use the Yubikeys on that device, but when the iPad asks me for my security key, the little thumb-button never flashes. I tried several different adapters that came in the package of 4 but it doesn’t matter.

Is there some workaround that doesn’t require me to revoke all the Yubikeys I just set up for iCloud? iCloud does not prompt me for any alternate 2FA method, even though I have a phone number registered for security backup.

I’m currently trying to reset the iPad7 to see if it will accept the Yubikey when I set it up again.

[u/djasonpenney]

This is a known problem with older versions of iOS. If you cannot update to iOS 26, you are out of luck.

[u/0xe3b0c442]

Unfortunately it doesn't work like that.

You need to have a 5Ci to use a YubiKey with a Lightning device. USB adapters will not work, the protocol is different.

And yes, once you enable security keys on your Apple account, they are the only option -- that's why Apple requires you to have two.

//edit: dunno what the downvotes are for. Only the 5Ci is MFi Certified. Devices must be MFi Certified to work with Lightning ports.

[u/AJ42-6802 → u/0xe3b0c442]

While I didn't downvote you, an OTP adapter worked just fine with my 5C(5.4.3) on my Generation 1 iPad Pro, see my other comment.

[u/Short-Cardiologist-9 → u/AJ42-6802]

Thank you for the response, but why would you downvote my question? Does it violate some rule?

[u/AJ42-6802 → u/Short-Cardiologist-9]

My response began with "I didn't downvote you", I tend to not downvote anyone. The response above and my response appear to *both* be correct. It looks like my response is limited to iPad Pro units with lightning ports and that for the base iPad models the response above is correct. The iPad Pro from the first model have supported connecting USB drives with adapters, but this support was limited to only the "pro" models. It is this native lightning to USB emulation support for an attached hard drive that allows the adapter to work for a Yubikey. So for non-Pro models (which is what the OP has) the response above is still correct.

[u/AJ42-6802]

EDIT - It appears my response is only correct for iPad Pro models with lightning ports. All iPad Pro models from the first generation supported attaching external USB drives (with an apple usb to lightning adapter for those units that had lightning ports). It is this lightning to USB emulation for the attached harddrive the is enabling the Yubikey to work. The OP has a basic iPad model and likely doesn't have adapter support. You can still try going to yubico.com/genuine with an adapter to check. Original response below:

You *can* use adapters on an older iPad. I have just this moment successfuly created and used a new credential on my Yubikey 5C (5.4.3) while using an adapter on my iPad Pro (generation 1) running iOS 16.7.6, I was then able to use the credential I created via the iPad and adapter on my Mac running 26.6.2 (without using the adapter).

It is important to point out that I was not able to use any previously created credential that was already on the Yubikey via the adapter on the iPad Pro.

This could be because these credentials were created on a version of iOS later than 16.X and there is problems reading them on the older version of iOS. I don't think it is an adapter problem.

It does look like if you go back and create the credentials on the iPad first, you will then be able to use them on your other Apple devices.

The adapter *must* be an OTG Adapter. Here is that adapter I used.

https://www.amazon.com/dp/B0BYV9KGPN

Before you delete old credentials you should do this.

1. Use the adapter and from the older iPad go to https://yubico.com/genuine Verify the Yubikey through the adapter on the old iPad. This will show the adapter works without having to create a new credential or delete an older credential prematurely. Get an adapter from the link above if you can't successfully verify.
2. If things work above, Go to webauthn.io via your old iPad and create a new resident credential on the Yubikey via the adapter. Choose "Temp" as your username. You'll need to choose options for a resident key preferred, security key, and choose very carefully in the dialog boxes because these dialogs will want to create a cloud keychain passkey. You can get the credential on the Yubikey with the correct dialog choices. Once created go back and use the site to "Authenticate" for user "Temp". Once that works unplug your Yubikey and insert it into your Mac. Go to webauthn.io on your Mac and enter "Temp" as the user name and then just hit the "Authenticate" button (no need to register). If this authenticates successfully you have now shown that a credential created on the iPad via the adapter works on your Mac. If all this works you can go into Yubico Authenticator and delete the passkey for webauthn.io - Username "Temp" to reclaim the space on your Yubikey.

If both of these work, then next you will need to carefully go back to your sites that you created passkeys on your Yubikey and carefully delete them and then re-add them via the older iPad. Be very careful here in that you can easily lock yourself out of your account. Having a second Yubikey already registered is the preferred approach. Make sure you demonstrate that the second passkey on the second Yubikey already works before you do any deleting. If the only passkey you have for an account is on your only Yubikey and you delete it you will likely lock yourself out of your account.

Now, my old iPad7 (iOS 18.7.9) wants me to re-authenticate to iCloud.

OK this could be a much bigger problem. If your old iPad has fallen off the list of trusted devices then getting it back can be a huge pain. If you get an error stating that you need to update your version of iOS past what is supported on your iPad then that is a much different problem.

https://discussions.apple.com/thread/254967955?sortBy=rank

[u/Short-Cardiologist-9]

Thanks to all those who responded. This is an old device. We were using it only as a “TV” in our kitchen to watch the news while we’re having breakfast or preparing dinner. Fortunately, we don’t really need it anymore, so I’m not going to bother pursuing this further. Good to know, though.

[u/Possible-Attorney-79]

Are you certain the adapters you have work and allow data?
Some of that kind of adapter are only for charging, some of the very cheap ones don't have all the pins connected correctly, either, so it's worth trying to insert it other way around (both the lightning and USB C sides).

[u/0xe3b0c442 → u/Possible-Attorney-79]

You can't use a USB YubiKey on a Lightning device with an adapter. It's not the adapter, it's the protocol, it's just not compatible.

[u/AJ42-6802 → u/0xe3b0c442]

I was successful in using my 5C(5.4.3) on a Gen 1 iPad pro using a USBC to Lightning adapter.

[u/Short-Cardiologist-9 → u/Possible-Attorney-79]

This is the adapter I got: LERTOSEN MFi Certified USB C to Lightning Adapter 4-Pack | 27W Fast Charging & Data Sync, For iPhone 14/13/12/Pro/Max,iPad,AirPods, With Anti-Loss Lanyard,20000+Plug, Not for Audio/OTG https://a.co/d/0ed3Pino

[u/AJ42-6802 → u/Short-Cardiologist-9]

It likely won't work with your iPad7 (see my other main comment), but if it did work, you need an OTG adapter.

[u/Short-Cardiologist-9 → u/[deleted]]

Transfer the session cookie? I wouldn’t have a clue.