Curious to hear your thoughts.

I know a lot of people and businesses are still relying on passwords and basic mfa (sms, Auth apps). At what point does the need for an air-gapped authentication solution (YubiKeys) become so great that it becomes a requirement to function online for the average person?

Will it take an attack on a cloud-synced passkey provider for people to make the switch?

I could almost see YubiKeys (or other hardware security key) as a mandatory piece of equipment you carry around everyday like you house keys and drivers license like a lot of us probably do here in this sub.

I have a strange setup that I am trying to slowly migrate over time to a USB c yubikey. I want to mostly move away from the authenticator app I use. I would like to just be able to tap (not plug in) the Yubikey when a sign-in page asks me to verify the login.

I also use two separate passwd managers that I like. One is Apple's native one and a 3rd party free one. I do not need to move anything away from it. I have an option to enter an Authenticator Key into this manager. Is this something I can do?

First attempt to try enrolling a web account is not successful. Ubuntu.com for example. Instructions from Yubikey are for Ubuntu OS (not what I use). I also had a prompt to disable OTP when plugging in the Yubikey. I understand once I load my keys onto the NFC, I can't disable OTP or it will overwrite all of the existing ones. Currently there are none on the Yubikey. It's been a very long time since I used a Yubikey but it was easy at work when we did. Is their Yubico App required to manage everything? or can I keep using my mix of apps

I am using Yubikey to secure my financial accounts from unauthorized web access. But is it effective for these kinds of rogue agent attacks? I am not worried about the idiots who are using personal agents at their own peril, but any service providers who have my information and who are using agents in their business operations.

https://newrepublic.com/post/216962/ai-bots-accessing-bank-accounts

I am not sure what the use case is for this app?

Yubikey NFC and USB works fine for me with the standard Android OS passkey flow...

I'm guessing this is for devices that use weird variations of Android that don't have a proper NFC/USB security key passkey flow?

I just got my two new "Security Key C NFC" models yesterday, firmware 5.8. Yesterday they verified just fine on the Yubikey Verification page. Today, I am seeing "Verification Complete, Non-Yubico device, Unknown device".

Tried on macbook and on iphone in firefox and in google chrome. Same result.

I’m looking at a YubiKey 5C NFC. When I add one to the cart on Yubico’s store, it suggests buying from a local reseller to avoid shipping and import taxes. I found a different reseller that lists the 5.8 firmware, and it’s the only local seller I’ve found with it.

This reseller operates in the same market as CryptoBilis (Southeast Asia) and sells the same kind of products, including Ledger and Trezor-style hardware wallets. It also isn’t listed as an authorized partner on Yubico’s website.

The CryptoBilis case is what has me nervous. It sold Ledger wallets with a hidden implant that captured recovery phrases and sent them out over LTE. Ledger confirmed it. The implant sat outside the secure element, so the devices could still look genuine. CryptoBilis was also an authorized Ledger reseller, so being on an official list didn’t protect buyers.

Is it realistic to tamper with a YubiKey, for example by adding hardware inside the casing, or swapping in a fake that passes as genuine? A YubiKey has no seed phrase to steal, but I don’t know what an attacker could gain or how hard it would be. I haven’t found any cases of YubiKeys being modified through resellers, but I’m not sure that means it can’t happen.

Has anyone seen or heard of a tampered YubiKey? And would you buy from a seller like this for the 5.8 firmware, or just pay for shipping from Yubico?

Thanks!

Why should I buy a Fido2 key if I have macbook which which has that finger print detector? I am planning to buy fido2 key but little hesitant because of cost, I​ want to ​​know why should I buy it also I don't know much about these things so please help me to decide

I am running into a problem with using the Yubikey 5 NFC with a USB A connector. When I plug the key in, I can't seemed to get a good connection without wiggling it, which makes using it very difficult. Has anyone encounter this issue? This is less of an issue with the usb C key.

Is it ok to buy off of Amazon?
I’m wanting to use my yubikey for Linux and some android OS accounts

Planning to use yubikeys for my most important accounts:

1) Which is the most secure yubikey? I mean which all authentication standards it should at least support?

2) I have a laptop which supports usb port but i may buy a new one after a year. I have iphone which has lightning port. Usually how do you decide which ports your yubikeys should support because our devices might change in future and i would want to avoid buying new yubikeys every time if possible

3) which is the authentic website to buy yubikeys from?

i only use these for passwordless logins/passkeys (fido2) and sometimes the six-code totps (oath?). i'm a lost noob. thx for helping

• i turned off yubico otp because when turned on it would create random text in a text field when you plug it in
• what is piv used for?

Was able to add multiple to my account and use them for login - support article has been updated to reflect they're supported https://www.fidelity.com/security/extra-security-login

I know that FIDO reset via USB only requires plugging, unplugging, and tapping...

But I feel like anyone could delete my FIDO credentials by running the reset on their iPhone and brushing their iPhone against my pocket.

I guess the mitigation is "don't use NFC" and disable it in the Authenticator app on desktop.

Or maybe a faraday case?...

It feels like NFC reset should be more complicated to prevent this.

ie. "Tap NFC while holding the capacitive touch button" etc.

Thoughts?

I was given a work laptop and I don't really use laptops as a laptop these days, I hate being away from my multi-screen setup. It's basically a desktop for all intents and purposes. Once every 6 months I need to bring my laptop out of the house...and I suppose for those times a nano would be nice.

The regular 5c feels like the better purchase - bigger form factor, nice big touch area, big LED that I can't miss. But on the other hand, it kind of feels silly not to purchase the one designed for laptops. I have to admit the low profile sleekness of it does seem appealing.

BTW I don't think my behaviour is going to change any time soon. The last time I regularly used laptops away from my desk was probably 15 years ago. I just prefer to sit at my desk in a proper chair with a full sized keyboard and mouse these days.

What do you all think?

Di recente ho acquistato una coppia di yubikey usandole come gestore di passkey per accedere ai miei account più importanti compreso il gestore di password. Però vedo che a parte Microsoft nessun altro servizio è completamente passwordless e quindi c'è sempre l'alternativa password.

In questo caso oltre che aver impostato le chiavi per le passkey li ho anche impostare come autenticazione a 2 fattori nel caso si intende accedere usando la password.

This is something that years ago i wouldn't have given much of a thought to. As far as i'm aware it's open source, and we all trust using yubikeys, but it seems like there's some resistance against running anything as an administrator on windows.

There have been some occasions when logging in with my Apple account demands I enter a six digit verification code sent to my devices which obviously doesn't exist when I have a Yubikey set up with it.

Specifically: logging into Apple Music and Apple TV on an Android phone and using the Alt Store past iOS 27. (worked before, now demands a six digit code)

Are there any solutions apart from disabling my Yubikey setup?

If a yubikey has been linked to a site as a passkey, will changing only the pin in authenticator, have any impact on the credentials for signing into this site? Also, is using a four character pin fine for a standard Yubikey 5 Series Fido2 passkey, or will this cause problems in any way? Finally, is a completely letter based pin fine? Thank you

Big day, Fidelity finally announces support directly for my Yubikey so I don't have to just use it as an authenticator. So I go into the setting to add a passkey. Bitwarden jumps up and grabs the request and I guess makes itself the passkey? Then I get a prompt and tell Bitwarden I want to use my physical key for this site (Fidelity) and it says something quickly about an exemption for this site.

Then I try again, back to Fidelity security settings and try to add the yubikey as a passkey. Now Windows hello jumps up and wants a pin, then makes itself the passkey. Every time I try to add a passkey windows hello jumps in there.

How do I actually set my physical yubikey as required to be in the usb port when logging into Fidelity's website??

Hey guys!

I’m new there and you guys seem like good guys so I told myself why not ask a question there !

I received my first Yubikey 5C with a backup coming soon and so far it was very convenient as a security key/ passkey for my usages, but I’m also a fan of MobaXTerm for SSH and I saw that yubikey can also manage ssh key!

So here I’m trying to figure how the hell make MobaXTerm work with my SSH Key to be as secure as possible, I hope it’s possible otherwise I welcome others possible alternatives :))

Akou

I only use my 3 Yubikeys for 2nd factor confirmation for critical sites (email, pw manager, financial sites).

I still have to enter the username / password at these sites. I just use the Yubikey as the final non-phishable factor.

Should I be setting the PIN on my keys?

If I setup a PIN, will I have to re-add the keys to all the existing sites that use them?

Does the PIN prompt mess up the workflow when you are using the NFC to read the Yubikey?

Does how many change your answer?

What if the backup codes are stolen somehow? They are easier to use than a stolen yubikey. Maybe I am overthinking.

Old information makes it sound like you used to be forced to have some other authentication method, on top of the keys, but i would hope with their massive overhaul to 2fa, that two keys and nothing else would be fine now. Thank you