r/yubikey

Why doesn’t Yubico enable FIDO2 PIN complexity by default on standard YubiKeys Series 5 that is advertised on their website

From what I can see, stronger PIN-complexity enforcement appears to require specific models such as Enhanced PIN keys, which may be tied to subscription/enterprise purchasing? Other vendors, such as Token2, seem to offer PIN-complexity enforcement as a standard feature on some models.

For a smaller business with dozen or less than 200 users, is there really no standard retail YubiKey option with enforced PIN complexity?

I'm dipping my toes into the Yubico ecosystem and moving some critical IDs to a Yubikey USB-C security key. I've started with Apple ID and Entra ID.

This is working great so far, but I've not tested NFC yet for iOS & other mobile OS. I downloaded the Yubico Authenticator app and tried to tap my key and got this error. What am I doing wrong?

https://preview.redd.it/amp2gfyzn4kh1.jpg?width=1182&format=pjpg&auto=webp&s=1c3d116052fbd4aaaea0308350159e0941a25267

with car key remote hacking (keyless entry relay attacks) and financial card hacking (RFID/NFC skimming of debit/credit/crypto), it is reasonable to question the safety of NFC on a Yubikey

I have an older yubikey USB-A model that works fine on my chromebook to authenticate on a google account. It doesnt work with my phone (even after getting an adapter). If I get a Yubikey 5C NFC can I add key that to my verification methods and use it on both my chromebook and phone google account? Will adding another yubikey interfere with how my older yubikey works on the chromebook or would I need to delete that from the google account first ? Is there a way to make my current yubikey work with my pixel phone? Sorry for the questions, very unclear about how the key works and what approach I should be taking

Hi there, I’m considering grabbing some Yubikeys for account security. Pretty much every product I own is USB-C but I don’t know much about the different products, would you recommend USB-C model, is NFC better, worse or the same?

Never used a product like this so please forgive if it’s a stupid question

I'm brand new to the security key / passkey space. I just bought a 2-pack of the YubiKey 5C NFC keys. I want one on my key ring, and the other in my safe. It make sense to me that I have to set up both keys separately for any account I want to protect.

Under LastPass' Account Settings > MultiFactor Options there is a section for Yubico OTP. However, it's description says:

"Use an older YubiKey device that only supports Yubico OTP. To use a newer YubiKey device, go to LastPass MFA (above). Pro tip: This is also where you set up YubiKey for LastPass mobile app verification."

When I use the LastPass MFA option, it walks through setting up a Primary and Backup method, but it registers both options on the first YubiKey (FIDO2 as Primary and a different protocol as Backup). If I walk through the process a second time for the second key, it overwrites the first key which no longer works to access LastPass.

Should I be using the old Yubico OTP option for Lastpass authentication instead?

I work part time at a major US hospital. My password is 20 digits for some reason. It’s a fucking nightmare to log in. Is it worth asking them if I could use a yubikey instead or does the hospital have to be set up for it? Or is that use case not appropriate? I’m honestly still confused over Passkets, passwords and hardware tokens. And I’m minoring in cybersecurity lol

Why in the world would I want to hobble my Yubikey so I have to drag a laptop along with it just to sign onto Microsoft. I’m trying to unhobble the key but I can’t see any way to do it on the Microsoft website. EDIT: 8/12/2026 Having read the comments I have gained a better understanding. This is a sample of the ambiguous message displayed on my screen:

“This passkey can only be used on the DEVICE where it was created. If you lose the device, you won't be able to use it to sign in to your Microsoft account.”

They could have written: “This passkey can only be used on the HARD TOKEN where it was created. If you lose the hard token…”

(The word “Passkey” is a newly adopted word added to the internet login technology lexicon in 2022.)

Hey all, I'm wondering if what I thought Yubi keys could just is out of scope for what they are? Maybe I don't understand the use case? (probably). So I wanted to post what I thought they can do. Can someone set me straight? Thanks in advance.

So work said we're going to be moving to YK down the road. I thought I'd get a jump on it and get my own (plus the tech is cool). So I bought 2 keys. Thinking 1 would be my main and the other a backup.

Here's what I want to do.

Main key:

• Add it to my personal Microsoft account.
• Add it to 1Password.
• Add it to MS Auth.
• Add it to my Apple account. (iPhone requires 2 keys)
• Add it to my work Microsoft account.
• Add it to my work Microsoft Admin account.

2nd key:

• Backup of main key, all accounts above.
• Already added to iPhone since they require 2.

Am I asking too much for these keys? Goal is to simplify login at work and home. We have Entra security keys enabled at work FWIW.

These are the keys I have.

Security Key C NFC | F/W 5.8.0 | FIDO U2F FIDO2

On my iPhone, when I try NFC via Yubi auth, it errors out "the requested functionality is missing or disabled". So I checked via Yubi auth and both NFC apps are enabled (FIDO U2F, FIDO2).

Sorry for the long post but I wanted to ask the hive mind as I sit through these YouTube vids. ;)

Thanks!

Hello people could someone just explain to me why use a yubikey as I have on 2fv on my email so why buy yubikey ?
Sorry I’m a newbie in all this.

Edit: thanks people for taking their time to reply really learn stuff here. So I made the decision to use yubikey. Probably gonna have some set up questions but that’s a problem for later. 😏

A couple of years I have opened my .kdbx db on keepassXC with master pw , keyfile and yebikey. Now I want to configure a now secret on my challenge-response. Therfore I remove challenge-response in keepassxc db settings.

When I now try to open the .kdbx db w master pw and keyfile I get the red upper message: db could not be loaded or something.

When I try to open db with master pw,keyfile and yubikey ( old secret): again red message.

Is reco´figuratin challeng-response not stable in keepassXC?

Hi people, after my last post, I purchased 2 YubiKeys, but I still have some confusion. No one in my circle using yubikeys so I really don’t know who to ask. So hope you don’t mind me asking some really idiotic questions.

I am setting up YubiKeys for Google for 2 factor authenticator just curious do you guys still have your authenticator app on?

I do know many people recommend having the backup codes on and I did. But the Google prompt is unable to turn it off unless I use the advanced protection programme. But I do want to have security. Personally, I think it would be a hassle if I lost my YubiKeys ( I bought 2 so it's very unlikely I will lose them, but just this irrational fear of what if I'm unable to recover my account ) So any suggestions ???

Do I need a YubiKey authenticator or continue with Google. I do know using YubiKeys would be more secure as u need the key to access the 6-digit number personally think that would be very secure but isn’t it a bit of a hassle ??? Can people share some experience/suggestions with me

Lastly when I sign in Google I noticed when u press the try another way for the 2 factor verification it mention “ get one time security code “ press on it and it seems that u have to use this smart lock app ???? I have no idea what is that and I didn’t seem to enable that in my 2 step verification any ideas ???

I have 2 YubiKey 5 NFC.

https://preview.redd.it/47vg3nun7qih1.jpg?width=3024&format=pjpg&auto=webp&s=9b6372a3cae043ee8eb759b457563bb1c3dc669c

Today I've got my yubikey (before that i had two token2 keys). Already configured all my most important accounts but I still wonder how else could I use the yubikey? Do you guys use the PIV app? If so, then how? What are your usecases for it? Do you use the PGP app (signing messages, emails, commits)?
Also I know that youbikeys have static passwords but i don't really know where i can use it. And for some reason the "Slots" option where i can configure it is grayed out. Does that mean that my yubikey does not support it? I have a YubiKey 5C NFC

Maybe I’m glossing over something basic or making a glaring error in my workflow but after setting 2FA with the Yubico Authenticator on one key, I can’t figure out how to set the backups or how to give the backup keys the same certificate to generate codes.

Websites with Passkeys allow additional spots but for accounts still stuck on authenticator codes, it only allows one slot. What am I missing here?

Hey folks, I have recently been reviewing my account credentials and security. I primarily use apple products and have two yubikeys set up for my important accounts.

I’ve learned recently that my aging parents are saving their passwords in insecure methods. I’ve tried to push them towards password managers. My father is in charge of my parents credentials and I’ve gotten him set up with a password manager and I’d like to set up two keys for him as a mfa for his apple and google accounts.

I was thinking of setting up the two and storing the back up for him.

I suppose my question is if anyone has experience setting up security keys for their parents. Did you run into any issues? Was it easy enough for them to use the nfc feature? Were the keys durable enough to be dropped repeatedly/accidentally?

Any feedback would be appreciated.