YubiKey

“yubikey in the fido/webauthn form protects against phishing/TOTP snooping and replay over the web”

“the user gets to authenticate the use of the secret, but it never leaves the hardware token”

“the device doesn't work against me in such a way it would require installing custom software on it”

“I'm using a Yubikey that is permanently plugged into a USB-C port on my laptop and another one in my dock at home.”

“their hardware tokens are physically incapable of any kind of sync, so a Yubikey passkey is very quickly a single-point-of-failure”

“I use multiple Yubikeys with passkeys and feel better about the auth experience than any other solution thus far.”

“Many websites and apps (especially apps) support passkeys but would prohibit using your Yubikey as a passkey.”

“If mobile banking really wanted to be secure, they would support something like a NFC yubikey for transaction verification.”

“I only have so many slots on my hardware key. And now sites are moving away from supporting U2F towards a passkey-only model.”

“I like Yubikeys as well but they are super inconvenient by comparison when dealing with multiple devices.”

“it is a good idea to get a yubikey and use PAM to require a physical user presence check”

“I'd trust Yubikey RNG mixing into Linux urandom much more than a random hardware wallet developer.”

“People were encouraged to use the later but as soon as the keys were not exportable, phones were acceptable.”

“Except enrollability. Got a new account? You need physical access to both tokens to enroll it.”

“I've had much more luck with onboarding non-technical people into a yubikey vs a password manager.”

“it is truly safer than their physical notebook because they are safe from being tricked into entering their password in the wrong place”

“they were "not compatible enough" and in fact, it seemed that sites weren't interested in adding or even maintaining existing support”

“nothing new and useful in this at all and nothing they announced is usable for anybody today”

“Yubico shipped firmware whose headline features nothing can currently use, is not relevant for existing hardware”

“Once you have a Yubikey (preferably two, so you have a backup if you damage/lose one) - you may as well make _that_ your primary MFA method”

“Physical devices are fairly easy to understand, and a simple on-device PIN or fingerprint-reader adds a 2FA that prevents a lot of fraud.”

“Actually now I use my yubikey to authentice so I don't have to type my password for sudo.”

“lots of folks own Yubikeys or FIDO2 keys - if these became the norm then the price would come down significantly”

“I personally keep a separate YubiKey that—along with a memorized password—is sufficient for me to retrieve my password manager database”

“The challenge to auth happens inside the Yubikey and the secret never leaves the Yubikey.”

“obtaining the largeBlobKey does not require User Presence, which IMHO lowers the essential security guarantees”

“If your 2FA is a proper device, like a Yubikey, the attack surface is tinier than tiny and the device ensures that your secret never leaves the device.”

“the decryption code I'm aware of forces user presence whether or not the Yubikey requires that”

“It was kind of a pain because we had to support some ancient IE versions and Yubikey basically only worked on Chrome at the time”

“I do nearly all my 2FA with Yubikeys, I carry one with me on my keychain and then I have another one in a safe as a backup.”

“there's a better way with far superior UX: derive an SSH key from a FIDO2 slot on the YubiKey”

“The biggest issue I ran into was when folks wrote some tools that rely on ssh sock auth”

“IMO the baseline Security Key ($20) series is now enough, unless your setup uses PGP, legacy SSH that doesn't support these key types”

“almost everyone I know quickly gets sick of touching the yubikey for every git remote operation”

“I bought several "Security Key NFC by Yubico": their cheapest model, no storage or fancy stuff.”

“SSH using GPG Yubikeys and git signing using GPG was quite a process to set up on Windows a few years ago”

“so you can't (as easily) get tricked into entering some TOTP (or email/sms) code into a fraudulent website.”

“with portable devices like Yubikey it's possible to create a master Certify-only GPG key”

“Works pretty nice as well and has the added bonus of your key not being tied to a pice of hardware”

“Your "disaster recovery" should be either a second device with a Secure Enclave, or a Yubikey.”