# YubiKey 206 Hacker News commenters recommended YubiKey and 62 criticized it, November 2025 to November 2026. It was recommended in 13 of 13 months; owners who said how long report a median of 7 years (7 owners). It meets the Hacker Approved badge rule. **Verdict:** A physical 2FA and passkey key that keeps secrets on the device and blocks phishing, best bought in pairs; critics cite patchy site support and no syncing between keys. ## Why people recommend it - Secret never leaves the device (3 comments): "If your 2FA is a proper device, like a Yubikey, the attack surface is tinier than tiny and the device ensures that your secret never leaves the device." ([source](https://news.ycombinator.com/item?id=47194376)) "the user gets to authenticate the use of the secret, but it never leaves the hardware token" ([source](https://news.ycombinator.com/item?id=50169889)) "The challenge to auth happens inside the Yubikey and the secret never leaves the Yubikey." ([source](https://news.ycombinator.com/item?id=47796315)) - Strong protection against phishing (3 comments): "it is truly safer than their physical notebook because they are safe from being tricked into entering their password in the wrong place" ([source](https://news.ycombinator.com/item?id=49009875)) "so you can't (as easily) get tricked into entering some TOTP (or email/sms) code into a fraudulent website." ([source](https://news.ycombinator.com/item?id=46102716)) "yubikey in the fido/webauthn form protects against phishing/TOTP snooping and replay over the web" ([source](https://news.ycombinator.com/item?id=50226709)) - Handles SSH, sudo and GPG (4 comments): "there's a better way with far superior UX: derive an SSH key from a FIDO2 slot on the YubiKey" ([source](https://news.ycombinator.com/item?id=46408324)) "Actually now I use my yubikey to authentice so I don't have to type my password for sudo." ([source](https://news.ycombinator.com/item?id=48088763)) "it is a good idea to get a yubikey and use PAM to require a physical user presence check" ([source](https://news.ycombinator.com/item?id=49500653)) - Keep a second as backup (4 comments): "Once you have a Yubikey (preferably two, so you have a backup if you damage/lose one) - you may as well make _that_ your primary MFA method" ([source](https://news.ycombinator.com/item?id=48594226)) "I do nearly all my 2FA with Yubikeys, I carry one with me on my keychain and then I have another one in a safe as a backup." ([source](https://news.ycombinator.com/item?id=46439709)) "I'm using a Yubikey that is permanently plugged into a USB-C port on my laptop and another one in my dock at home." ([source](https://news.ycombinator.com/item?id=50050566)) ## What people warn about - Spotty website and app support (4 comments): "they were "not compatible enough" and in fact, it seemed that sites weren't interested in adding or even maintaining existing support" ([source](https://news.ycombinator.com/item?id=49002273)) "It was kind of a pain because we had to support some ancient IE versions and Yubikey basically only worked on Chrome at the time" ([source](https://news.ycombinator.com/item?id=46591446)) "I only have so many slots on my hardware key. And now sites are moving away from supporting U2F towards a passkey-only model." ([source](https://news.ycombinator.com/item?id=49755547)) - No sync; enrolling multiple keys (3 comments): "their hardware tokens are physically incapable of any kind of sync, so a Yubikey passkey is very quickly a single-point-of-failure" ([source](https://news.ycombinator.com/item?id=50050328)) "I like Yubikeys as well but they are super inconvenient by comparison when dealing with multiple devices." ([source](https://news.ycombinator.com/item?id=49754918)) "Except enrollability. Got a new account? You need physical access to both tokens to enroll it." ([source](https://news.ycombinator.com/item?id=49014273)) - SSH and GPG setup friction (3 comments): "SSH using GPG Yubikeys and git signing using GPG was quite a process to set up on Windows a few years ago" ([source](https://news.ycombinator.com/item?id=46391447)) "almost everyone I know quickly gets sick of touching the yubikey for every git remote operation" ([source](https://news.ycombinator.com/item?id=46393389)) "The biggest issue I ran into was when folks wrote some tools that rely on ssh sock auth" ([source](https://news.ycombinator.com/item?id=46401784)) - New firmware features unusable (2 comments): "Yubico shipped firmware whose headline features nothing can currently use, is not relevant for existing hardware" ([source](https://news.ycombinator.com/item?id=48997916)) "nothing new and useful in this at all and nothing they announced is usable for anybody today" ([source](https://news.ycombinator.com/item?id=48998841)) ## Alternatives hackers recommend - [Nitrokey hardware security key](https://hackerapproved.com/p/nitrokey.md): 8 recommend ## Where to get it - [See price on Amazon](https://www.amazon.com/s?k=Yubico+YubiKey+5+NFC+security+key&tag=hackerapprove-20) (affiliate link) - [Official site](https://www.yubico.com/) ## Cite as Hacker Approved, "YubiKey", https://hackerapproved.com/p/yubikey/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).