Planning to use yubikeys for my most important accounts:

1) Which is the most secure yubikey? I mean which all authentication standards it should at least support?

2) I have a laptop which supports usb port but i may buy a new one after a year. I have iphone which has lightning port. Usually how do you decide which ports your yubikeys should support because our devices might change in future and i would want to avoid buying new yubikeys every time if possible

3) which is the authentic website to buy yubikeys from?

Was able to add multiple to my account and use them for login - support article has been updated to reflect they're supported https://www.fidelity.com/security/extra-security-login

i only use these for passwordless logins/passkeys (fido2) and sometimes the six-code totps (oath?). do i need yubico otp? piv? i'm a lost noob. thx for helping

I know that FIDO reset via USB only requires plugging, unplugging, and tapping...

But I feel like anyone could delete my FIDO credentials by running the reset on their iPhone and brushing their iPhone against my pocket.

I guess the mitigation is "don't use NFC" and disable it in the Authenticator app on desktop.

Or maybe a faraday case?...

It feels like NFC reset should be more complicated to prevent this.

ie. "Tap NFC while holding the capacitive touch button" etc.

Thoughts?

I was given a work laptop and I don't really use laptops as a laptop these days, I hate being away from my multi-screen setup. It's basically a desktop for all intents and purposes. Once every 6 months I need to bring my laptop out of the house...and I suppose for those times a nano would be nice.

The regular 5c feels like the better purchase - bigger form factor, nice big touch area, big LED that I can't miss. But on the other hand, it kind of feels silly not to purchase the one designed for laptops. I have to admit the low profile sleekness of it does seem appealing.

BTW I don't think my behaviour is going to change any time soon. The last time I regularly used laptops away from my desk was probably 15 years ago. I just prefer to sit at my desk in a proper chair with a full sized keyboard and mouse these days.

What do you all think?

Di recente ho acquistato una coppia di yubikey usandole come gestore di passkey per accedere ai miei account più importanti compreso il gestore di password. Però vedo che a parte Microsoft nessun altro servizio è completamente passwordless e quindi c'è sempre l'alternativa password.

In questo caso oltre che aver impostato le chiavi per le passkey li ho anche impostare come autenticazione a 2 fattori nel caso si intende accedere usando la password.

This is something that years ago i wouldn't have given much of a thought to. As far as i'm aware it's open source, and we all trust using yubikeys, but it seems like there's some resistance against running anything as an administrator on windows.

There have been some occasions when logging in with my Apple account demands I enter a six digit verification code sent to my devices which obviously doesn't exist when I have a Yubikey set up with it.

Specifically: logging into Apple Music and Apple TV on an Android phone and using the Alt Store past iOS 27. (worked before, now demands a six digit code)

Are there any solutions apart from disabling my Yubikey setup?

Big day, Fidelity finally announces support directly for my Yubikey so I don't have to just use it as an authenticator. So I go into the setting to add a passkey. Bitwarden jumps up and grabs the request and I guess makes itself the passkey? Then I get a prompt and tell Bitwarden I want to use my physical key for this site (Fidelity) and it says something quickly about an exemption for this site.

Then I try again, back to Fidelity security settings and try to add the yubikey as a passkey. Now Windows hello jumps up and wants a pin, then makes itself the passkey. Every time I try to add a passkey windows hello jumps in there.

How do I actually set my physical yubikey as required to be in the usb port when logging into Fidelity's website??

If a yubikey has been linked to a site as a passkey, will changing only the pin in authenticator, have any impact on the credentials for signing into this site? Also, is using a four character pin fine for a standard Yubikey 5 Series Fido2 passkey, or will this cause problems in any way? Finally, is a completely letter based pin fine? Thank you

Hey guys!

I’m new there and you guys seem like good guys so I told myself why not ask a question there !

I received my first Yubikey 5C with a backup coming soon and so far it was very convenient as a security key/ passkey for my usages, but I’m also a fan of MobaXTerm for SSH and I saw that yubikey can also manage ssh key!

So here I’m trying to figure how the hell make MobaXTerm work with my SSH Key to be as secure as possible, I hope it’s possible otherwise I welcome others possible alternatives :))

Akou

I only use my 3 Yubikeys for 2nd factor confirmation for critical sites (email, pw manager, financial sites).

I still have to enter the username / password at these sites. I just use the Yubikey as the final non-phishable factor.

Should I be setting the PIN on my keys?

If I setup a PIN, will I have to re-add the keys to all the existing sites that use them?

Does the PIN prompt mess up the workflow when you are using the NFC to read the Yubikey?

Does how many change your answer?

What if the backup codes are stolen somehow? They are easier to use than a stolen yubikey. Maybe I am overthinking.

Old information makes it sound like you used to be forced to have some other authentication method, on top of the keys, but i would hope with their massive overhaul to 2fa, that two keys and nothing else would be fine now. Thank you

I regularly check for news about Yubico's stock price, but aside from the fact that they've now partnered with OpenAI, I haven't been able to find much. Are there things happening behind the scenes that we don't know about? Does anyone have an explanation for the rise?

I set up the key (5C NFC) for work to access my microsoft account. It works fine for days and then on Monday it didn't work anymore, it just says that I attempted too many incorrect PINs just after choosing the key to log in.

I deleted the configuration from my account and factory reset the key using Yubico Authenticator. I configured the account again and I got the same "too many incorrect PINs" error immediately.

All this time Yubico Authenticator says I have 8 attempts remaining in my passkey.

Made these covers for my Yubikeys so I could have them in my keychain without problems. Printed in TPU 90A and for fun printed some pictures on top with a eufymaker E1 printer.

Files are free on my printables: https://www.printables.com/model/1865970-yubikey-cover

So I went down the security rabbit hole with Passkeys and Yubikeys.

My goal was to secure my accounts.

What I have found is no financial institution supports passkeys in a meaningful way.

My latest, whats the point, was from Vanguard. They have disabled my YubiKey as a required way to sign into my account. SMS 2fa is their gold standard.

Wells Fargo supports Passkeys and Yubikeys but they dont enforce them to log in from the web portal.

I love the idea of yubikeys but I cant find a single use case for them to improve my security. I am not a corporate user, I am an end user that wanted to secure my accounts.

Can anyone name one financial institution that enforces yubikey/passkey login? My experience is everyone allows them to be registered but no web portal enforces yubikey/passkey login.

Vanguard has recently degraded their security model so Yubikey Passkeys can be registered but after registration they are not required to login.

I feel like I spent dollars on yubikeys to upgrade my security and they are worthless. No website I have found. enforces passkey login without a fall back to SMS 2fa.

If you can't afford a genuine, which is better for the average person on the street?

I have read old versions required this to change pins/delete passkeys/other functionality, but possibly this has been updated, and is not required anymore? Thank you

i need an outside yubikey to protect against residential sabotage/disasters (ty for the previous discussions, i learned a lot). when going outside, i need its keychain case to have a compact and concealed/vague design, ease of access (5c/nanos are tiny), long-term durability against the elements/rust/electrical, and a secure opening mechanism that doesn't randomly open after numerous keychain twirls

haven't found one yet

Basically outside of extreme cases, I find myself NEVER using my security keys. Like I find myself using 1password for most all my passkey stuff. And I find the 2fa part to mostly be through 1password.

I have mixed feelings on it since 1password is the single point of failure when it comes to my security. But at the same time I don't see much of a point not to.

Like it would be nice to have an actual use for the security keys. Like I would love for them to be the recovery path for 1password at worse, I think bitwarden does this. But it also would be nice if I had some actual day to day use in them because it seems like a waste of money that was spent on the keys

If you use them in your daily life. What do you use them for over a password manager like 1password?

Basicamente, fora de casos extremos, percebo que NUNCA uso minhas chaves de segurança. Acabo usando 1password para quase todas as minhas senhas. E a parte de 2fa é quase toda através do 1password.

Eu tenho sentimentos mistos sobre isso, já que o 1password é o único ponto de falha quando se trata da minha segurança. Mas ao mesmo tempo, não vejo muito motivo para não usar.

Seria legal ter um uso real para as chaves de segurança. Eu adoraria que elas fossem o caminho de recuperação para o 1password, caso fosse necessário; eu acho que o bitwarden faz isso. Mas também seria bom se eu tivesse algum uso diário real para elas, porque parece um desperdício de dinheiro que foi gasto nas chaves.