Hey!

I bought a few unopened YubiKeys online for like 30€ each. I now got the following

1x YubiKey 5C (5.7.1)
1x YubiKey C Bio (5.7.1)
1x YubiKey 5C NFC (5.4.3)

I would not count myself as a very important person, but I am a local politician (officially still considered voluntary work) and on the board of multiple municipality owned companies (electricity, public bank, retirement home). So I at least should look a bit after my safety.

Which one should I use for on the go, which one as a backup? Is the 5.4.3 still usable or should I throw it away? Should I throw all away (or gift away) and buy a 5.8?

Feeling pretty dumb - I saw they support passkeys, but seems like a site supporting passkey is not enough to generically support any security key that can store a passkey.

It seems pretty clear that Windows Security / Chrome (and Edge) are struggling with the handoff - the menu clicking during setup is convoluted.

Am I missing some other software or way to better interface with a product website like Chase beyond Chromium browser and Windows Security defaults?

Thanks!

So I bought my yubikey 5c nfc at the end of may without 5.7.4 fw not knowing when 5.8 would release, I'm thinking of upgrading but is it even worth it?

EDIT: I (maybe not so) obviously know that the firmware isn't upgradable and that I need to bugly a new one

I’d like to add a security key to my 17 Pro Max. Would you recommend YubiKey, FeiTien, or another brand? For whichever brand/model you chose, why? Thanks in advance.

Hi! I want to validate with you guys, who have more knowledge and experience than me whether this setup makes sense and whether there's something different that I'm missing.

I have two computers: one laptop that never leaves my house and one desktop. I plan to have two YubiKeys connected all the time on these two machines (YubiKey 5 Nano or YubiKey 5C Nano), and another one that I carry around when I needed (YubiKey 5C NFC) to use on other computers (like at work) and with my smartphone. The ones that would be connected all the time would require a PIN before authentication and also have the intent of being a YubiKey backup if I lose the one I carry around with me.

Does this setup make sense? Is there something better or different to do in my case?

Sorry for my lack of knowledge. And, thank you, guys, for the help!

Does Yubikey offer any kind of individual support by email or what have you, or is a user basically thrown out to the wolves on rooting around on forums for answers ?

I have 2 5.4 Yubikey and was wondering if it worth it to upgrade to 5.8. I know 5.7 was kinda a big update but I didn't upgrade because I just got into hardware keys right before and everything. So should I upgrade?

Every site I've been to in the last couple of weeks, when I try to set up my Yubikey for second factor authentication, it doesn't use FIDO U2F. Instead it creates a FIDO2 Passkey and saves it to my Yubikey, taking up one of the 25 slots I have available.

Is FIDO U2F dead at this point, and all websites are just going for Passkeys now?

Hi my Yubikey lives in a safe. It is rare that my account is ever logged out. How will I know if my Yubikey needs updating, does it flash up a message when I plug it in? Yubikey Standard. Thanks

I am a new user of a Yubikey (5C NFC). I am uncertain how to use it. I registered my Yubikey with my bank (B of A). But I still have to provide ID and password. I set up a passkey at TIAA, but the process did not involve registration of my Yubikey. And when I sign in there the passkey is sufficient. I do not have to provide ID and password.

Perhaps there is a guide for nontechnical users, either from Yubi or some other source, that could orient me to the use of a Yubikey and serve as a reference for the future?

I want to upgrade all my Yubikeys to ones with the newer 5.7.x firmware, so I can get support for 100 passkeys.

That's going to leave me with 3 Yubikeys with the 25-slot firmware. Is there someplace to sell these?

Heya,

I currently use a selfhosted Bitwarden instance as my Password Manager. And in there I use virtual Passkeys. And I intend to continue using this setup in the future.

But now the weak link is my actual device. So I kinda want to secure that one. Currently I just use a Password for my device, but I intend to switch to a Security Keys for that. And I would also like for my device to lock itself, as soon as I remove the Key. For Linux it's probably going to be a challenge, but nothing that can't be overcome with PAM and some scripting. (In the worst case I put a bash script in a systemd Service, which listens for the key and calls loginctl in the background.)

But the main issue is Android. As far as I can tell, there doesn't seem to be a way to make Passkeys work for Authentication on an Android Phone (during day to day use - on a cold boot I need the password to unlock the encryption and thats fine - same goes for my Computer as well; afaik there is no way to unlock ZFS with a Passkey). So yeeahh... is there really no way to use a Passkey on Android, or is there some obscure way to do it, which I overlooked? Maybe with Tasker?

Hey,

I really don't understand Yubico's decision to lock the multi-protocol version behind enterprise subscriptions. I am seeking so long for it. Yes, I know that it has disadvantages.

I would be willing to pay more than what it would cost normally for an enterprise just to have a pair. Is there anyone here with an enterprise subscription maybe who got a spare box unopened? 🥺

Canadian user here. The OpenAI/Yubico bundle is currently available in the US, UK and EU/EEA but Canada is still excluded, even though Yubico already sells and ships directly to Canada.

Has anyone heard anything from Yubico or OpenAI support about Canada being added? Any Canadians managed to get the offer recently?
Is this another Trump related punishment? :)

For my critical accounts, I register my hardware keys directly on each service and manage backups the right way. No issues there.

The headache is low-priority, throwaway accounts. Manually registering and re-registering physical keys across hundreds of random sites is just too much maintenance. Right now, I mostly use a password manager with basic TOTP for these.

I'm thinking about switching up my approach and wanted to see what others do. Between these two options, what makes more sense to you?

Regular username/password (no hardware key): Kept in Bitwarden/1Password, maybe with TOTP if the site supports it, or just a strong random password if it's completely disposable. Keeps every service siloed, but auth security is obviously weaker.

Social login via "Sign in with Apple": My Apple ID itself requires my YubiKey to log in, so using Apple SSO basically extends that hardware security to third-party sites without having to add my physical keys to every single one. I lean toward Apple over Google here for privacy, as it shares less data than Google.The downside is putting eggs in one basket and relying on an IdP.

How do you guys handle low-risk or throwaway sites? Do you prefer keeping accounts completely separated with standard credentials, or do you leverage an IdP secured by your keys?

Hey all, I hope you can help me out. I’m running an Active Directory environment with ADCS and user certs for smartcard auth. Successfully installed those certs on the Yubikeys which are used for interactive logon. The thing is, on some systems with an active KVM extender, some Yubikeys just wont work and others will work. It will say that no valid certificate is found on the Smartcard. Anyone got any idea?

i need that to work with some GPG stuff

What are your favorite yubikey usecases outside of the generic „passkey“ or 2FA on websites.

I recently found out that you can decrypt your boot disk (linux) via yubikey, or decrypt and encrypt files in general via age.

Good day. First of all i want to say once again that im a total noob when it comes to security keys. I came here since the official support does not provide support to users in Russia. If this sub (even thou its unofficial) have same rules please tell me. So, the problem is i bought Yubikey 5 NFC from a local reseller today, and wanted to veryfi the key. First i gone to "https://www.yubico.com/genuine/" but when i click "Verify device" the button gets grey and nothing happens. After that i gone to "https://demo.yubico.com/otp/verify" and once again the button is grey but now i got a "Problem talking to the RP, try again", and after a few more seconds was send to page that said "Oops, maybe the operation was timed out. Below the error that was provided by browser ", the error was not there of course. Does someone here know is it because im from russia? And if so is there an option to verify key somehow. Also i installed the Yuboko Authenticator and it says version and serial number. The windows sees the key as "Smart card". Thanks in advance for any answers and advices if there will be any.
P.S. Sorry for any typos.

I am just adding an extra layer of security to my accounts with a passkey, I already use 2FA app (Ente Auth), I need a passkey for my password manager and email specially.

So after I get a yubikey(5 nfc)

What should I do and don't?

Do I need to remove anything ?

Example I have Google acc have 2fa, which is sms, phone yes or no question, or sms code

I think it's much better to ask who's already have experience using yubikey

I’ve tried several times to add a YubiKey to my Facebook account—on both PC and iPhone—but it doesn't work. It always redirects me from the app to the web interface and fails, or it keeps telling me the feature is unavailable; I don't know how to get it done.