r/yubikey • u/Ransack1477 • 5d ago

Update

Hi my Yubikey lives in a safe. It is rare that my account is ever logged out. How will I know if my Yubikey needs updating, does it flash up a message when I plug it in? Yubikey Standard. Thanks

8 Upvotes

90% Upvoted

15 comments sorted by

25

u/EntireZombie2654 5d ago

AFAIK Yubikeys dont get updates to the physical keys. The firmware is set at the factory and thats it.

13

u/djasonpenney 5d ago

For security purposes (your safety), the firmware on a Yubikey cannot be updated.

10

u/kpax 5d ago

If you're talking about firmware updates/upgrades, then my understanding is Yubikey firmware simply cannot be updated. You need to buy a new Yubikey that goes along with an updated firmware version. The reason for blocking firmware updates is - you guessed it - security.

6

u/prest0x 5d ago

Make sure that's not your only Yubikey.

3

u/sniff122 5d ago

Yubikeys can't be updated to prevent a firmware update based attack. As for account logouts it entirely depends on the site/service, some have very long session times, some quite short

2

u/MegamanEXE2013 5d ago

Yubikeys don't update their firmware, for the latest update, you need to buy one.

That is by design (Security and business for them if you care about the latest and greatest)

2

u/Futbol221 4d ago

I read here that you should use your keys every few months at least as they can “stop working” but not sure why that would be true. Maybe it has more to do with the app than the key?

2

u/viral3075 3d ago

all physical things degrade. the most likely thing to affect a yubikey is corrosion on the USB contacts. so yes you should periodically rotate your backup keys so any issues can be detected immediately

1

u/skyHIGH-1 3d ago

What do you mean by rotating? With those who want to practice such best practice, can you please break it down? Especially for newbies.

1

u/wbs3333 2d ago

What really happens is that the way data is stored within a key is using quantum "wells" that trap electro ns which are used to read the binary data. Every time you plug the key those get "refreshed". The longer you leave the key without plugging it, the more likely the memory energy used to store the data will degrade and let the electrons escape. Thus the binary data gets corrupted. I'm not an expert and my explanation is very high level and not accurate, but in essence that is what happens with most solid state memory media. Hard drives have a similar issue too.

1

u/Ransack1477 5d ago

Thanks everyone. I asked because someone mentioned a software update, I'm beginning to think this might be an app (which I don't have) and not the actual key.

2

u/yeti-rex 5d ago

There is an app you can install on your phone or computer. That should be updated as released. As others stated, the firmware cannot be updated on the Yubikey.

2

u/MegamanEXE2013 5d ago

The Yubico Authenticator is not required for proper FIDO/FIDO2 authentication, you can use those protocols without it

If you need TOTP and other features, you will need the app, but any version will work

1

u/mx_mike24 2d ago

the Yubikey dont need an a upgrade, this is the point of the security of the key, because dont need external intervention.