I purchased my Yubikey last week. The initial reaction was a lot of frustration (even as software engineer with 26 years of work experience) as many of my most important sites (financial ...) would not use it or prevented me from accessing my security settings from home (microsoft office 356 from work). I did get two of my important accounts setup and that is very helpful as I don't always have my smartphone within arms reach. I am watching these videos to learn about the features and to enable more accounts when possible. Since I have only 1 key at the moment I prefer to have an option for a second form of 2fa to an authenticator app in addition to the key.
Once at the office I was able to setup my Yubikey with the more secure office 365. I have 2 different office 365 accounts from work because my employer is both a university and a large hospital system. I work for the university doing medical imaging research for the hospital system.
Excellent tutorial video, Chris !!! I would love to see some more to cover other online services (email and others) that can use these security keys. 🙂🙂🙂
I did this last year because people keep trying to break into my Gmail account for some reason and my Microsoft account. This pretty much put a stop to it especially my Gmail because my account is an original beta account and is very old, I think people want my alias for Gmail.
Hey Chris! Great and useful video to increase security by Yubikeys. Got my pair yesterday! Will follow your steps! Thanks and please produce more interesting vids ! 👍💪
Apple finally added NFC for Yubikey in 2019, and Android had it for years.... I was at Gartner IAM in Vegas in a meeting with yubico execs to bring them into my company as a security key provider when apple announced it. Everyone jumped up and celebrated over the news. Until then, Apple ONLY allowed NFC to be used with APPLE devices. I believe whole heartedly in FIDO and U2F and pushed to bring them into my company I work for as a Sr Lead Cyber Security Architect/Manager and was able to succeed. I use my Yubikey for all my accounts security and paired with LastPass where my Yubikey is the key to unlock my vault too where i have thousands of accounts stored and extremely secure passwords that I rotate every 90 days.... Not letting anyone in my world.
I am set on using hardware keys (also removing mobile numbers in ALL of my online accounts) because the Philippine government (I am currently living in the Philippines) recently enacted mandatory registration of prepaid SIM cards.
Or better don't use google services and secure other services with it. ...ok, that makes no sense to write this on youtube ;-D Good advice and thanks for all the good videos. Watching since years, but I think i never wrote a comment. What I really appreciate is that you do follow ups for many things!
@@BrewedIt Yes and no. Securing your services is always a good idea. Degoogling a bit is also something good. I never thought if the yubikey could be used to track someone, that is a thing I need to search for. If yes: it's to decide how valuable your googleaccount is. Enough to secure it otherwise or enough to buy more yubikeys or similar. And for degoogling: I think here it is about not to try completely go away, but in steps. E.g. there is not only gmail out there. Other search enginges could be useful, too. And a bit more competition could make some googleservices more userfriendly. But that idea with tracking because of the yubikey is interesting. I really need to research it. (Or wait a few weeks and Chris takes on this topic? ;-) ). However, thank you very much for this point I'm gonna to look after. In fact I just received yubikeys two days ago but haven't set them up.
I'm trying to find out if the "flipper zero" can emulate a yubikey (as i heard the flipper zero can copy and emulate any thing that uses wifi bluetooth or nfc) and let someone use the flipper zero to access your yubikey locked account
Curious how you use three different Yubikeys. I understand the best practice of primary and backup, but how do you use three in your daily life? I've put off moving from TOTP 2FA to U2F forever; thanks for the video to get me to finally order them.
Most people will only ever need 2 but for Chris specifically he’s got his company so it’s a bit different. It might be 1 for him, 1 for the second in command or the office, and 1 as a backup in a secure place. He’s talked about keeping 1 secure in a safe or bank before. Also it could be more than 3 as maybe each employee that needs access to the account gets one.
The only problem is with the Google id/pwd you can disable 2FA. It is a huge vulnerability. They should require the key to be touched before allowing it to be disabled.
I am finding a lot of good information on how to use a yubikey once it has been properly set up and activated, But i am not finding a lot of useful information on how to actually set one up and activate it... Any Suggestions???
I'm not sure if I did it right. For some reason, can only asked for my key one time. Unless I'm logging in into a new computer. Is that how it's supposed to be?
My Google account has an existing Yubikey registered and now I want to add a second key, but it seems Google changed the settings now it says "Passkeys and security keys" and it shows the existing security key but only shows the option to create 'Passkeys' not to add an additional security key. Is it still possible add security keys at Google?
thanks a lot for this great video!! But what about in the context of an office, I have multiple persons (let's say 4 in this example) wanting to sign in to a Google account from their office devices (6 laptops, 2 desktops, 1 tablet, 8 phones), how should I buy 4 Yubikeys and then register them in Google?
Why do google need to see the make and model of the key? Is there any way to bypass this on Windows? My friend on Linux could just select "no" and still get the key working.
I currently use Google Authenticator. Is it possible to keep that until Yubikey is installed and up & running. And THEN disable and delete Goggle authenticator?
Should we switch off 2 step verification after adding Yubikey ? And leave only that key? thx - maybe i miss that my English is like it is... thank you great content
Hey Chris thanks for another great Video. I did see this when it came out but just now set up my YubiKeys on my Google account. I did set up my YubiKey on Google using OTP. Now that I set up the physical key can I remove the OTP or leave it setup?
I have added 2, but it only shows 1 key in the list. When I try to re-add the other, it says “sorry this device has already been registered.” I wonder why they don’t both show up?
If I set up some accounts on my desktop computer with a Yubikey USB-A device won't I be locked out of accessing those accounts on my iPad? If so, is it possible to buy a Yubikey with a lightning connector and add it to the existing Yubikey 2FA methods? I'm a little confused on how this will work since I will be locked out of accessing the accounts on the iPad.
What do you think of v6 of the Yubico Authenticator Desktop App?... on the Mac, it no longer lives in the menubar and doesn't automatically copy the OTP after touching the key.
8:29 ¹ @crosstalk solutions this b/c you didn’t “unselect” don’t ask again for this device on your phone or PC; assuming that means won’t need to use the “Key” again? If that’s the case, the security is back to where it was or no; and also, if do forget to unselect that box…..how to you go into settings and clear out “saved devices”? Thx for this how to vid, dry useful and like that the key is also nfc for basically anything as laptops now support nfc; which also begs the question….is nfc secure enough to be using? Cheers✌🏻 ¹ edited cuz forgot the time stamp, OPPSY
Can the finger print be used/transferred/leaked as a means to identify you and connect you as the owner to your mail account online or does the finger print information stay within the hardware mechanism of the yubico key itself?
I am finding a lot of good information on how to use a yubikey once it has been properly set up and activated, But i am not finding a lot of useful information on how to actually set one up and activate it... Any Suggestions???
should i deactivate the possibility to login by using my phone and granting access? i login with email + pw and then there comes a popup on my phone which i can press yes and then i am logged in even though i have a yubikey
Chris, I get U2F using a Yubikey is better than OTP. But can the NFC data from the Yubikey be acquired and used for access, by using something like the Flipper Zero or another device?
Im using Keepass on Win 10. And Keepass2Android on my Samsung. Database is on a Server... Can i use the same Database from Win10 and my Samsung with a Yubikey? Not ordered 1 or 2 yet.
I use OTP on yubikey with backup on a fidesmo card using an authenticator app.. So unless they can mind control me to run the app and read the card, they ain't phishing anything.
Why did you leave the "Don't ask again on this device?" box checked on both of your devices? Doesn't that defeat the purpose of having all that security?
Is there a way to see what U2F keys are on a Yubikey? I have multiple Yubikeys like you and can't remember if all my accounts are registered to all the keys. Could not find anything online.
hi chris, Im trying to setup all the tp link hardware you showed in your previous videos but the DHCP authentication does not accept my ISP DHCP 60,61 request. The archer VR2100 can but this means having to purchase another router just to have the tp ER605 connect. I know there is no way around this so what method would you use? Ive been told i can change the subnet but by doing this i will get double NAT and some people still do this and no issues with their connectivity. I need your help!
I am finding a lot of good information on how to use a yubikey once it has been properly set up and activated, But i am not finding a lot of useful information on how to actually set one up and activate it... Any Suggestions???
Is it recommended that you add both the two keys to the account or is there a way to copy the first key seed (5NFC) and paste it into the second key (5CI) using the Yubikey software?
@@LionRoars918 thanks for the reply! Sounds easier to just add them separately then so they are more isolated and that way you can simply remove them individually if one was ever lost.
I show three yubikeys registered on my google account but I’m not prompted at login. Maybe I selected ‘trust this device’ or maybe have a SMS number listed too? Shouldn’t it ask on reboot, or when I open a google browser page? Or maybe I had google remember the password, and that bypasses U2F? Any pro tip to engage U2F? What are the instances where U2F will not engage? Also will it work with the iOS gmail app on my iPad?
Good video. However the serial or unique ID of your yubikey is something in the dark corner as to speak, that can be attributed to you. For those that like privacy it's another discussion all together.
Interesting that your painting on the wall is to UK colour code and not to the US. Or B instead of A depending on how you interpret it. Looks cool either way.
Is any info transmitted "home"? Anyone watch the packets? Sure , "checking for updates" every day is really "necessary", like Logitech garbage. Anyone not so gullible really checked?
Yubikeys are good, but if you've got a Mac with Touch ID on its keyboard then that's actually a very good alternative. Possibly better, as it checks your fingerprint whereas Yubikeys will work with anyone's finger. Either way, Mac users have built-in support for U2F for 2FA.
But Touch Id doesn't stop a random person from logging in to your Gmail if they have your password and have hacked your phone - it only controls access to your device.
@@GiveMeAnOKUsername no, you can store certain things (eg WebAuthn/passkeys) in the iPhone's Secure Enclave and these can only be accessed using Touch ID. If you know of a way to breach the Secure Enclave then I'm sure Apple would love to talk to you and pay you a huge bug bounty.
This is pretty unrealistic. An admin typically wouldn't both require U2F and also block USB. That would be dumb. And if you're trying to log into a U2F protected account from a kiosk computer or any device that doesn't have or blocks USB - then yes...you're out of luck. But again - unrealistic scenario.
@@CrosstalkSolutions would using USB yubikey then inherently reduce the security of the system by allowing end users to insert random USB sticks onto a corporate network connected device? Is there a tradeoff here?
@@CrosstalkSolutions we have admins who are looking to block USB mass storage devices. It is not clear if it'll block U2F keys too. Sounds like it could be a bit of an own goal :-)
It's also a problem if you are remoted into a system. For instance I RDP into my VM everyday for work and if I launch a browser on that machine and try to log in to an account I wouldn't be able to use my Yubikey. I've kept OTP on my Google account for that reason. I don't really see an easy way around it.
Finally someone who explains and shows clearly.
Many channels lot of fuss and not proper explanation. Thanks for that. Gtz
you make some pretty niche content but its valuable to those who deliberately search for it, keep it up
That flashback shot to 2020 was striking! Such a different visual look!
I purchased my Yubikey last week. The initial reaction was a lot of frustration (even as software engineer with 26 years of work experience) as many of my most important sites (financial ...) would not use it or prevented me from accessing my security settings from home (microsoft office 356 from work). I did get two of my important accounts setup and that is very helpful as I don't always have my smartphone within arms reach. I am watching these videos to learn about the features and to enable more accounts when possible. Since I have only 1 key at the moment I prefer to have an option for a second form of 2fa to an authenticator app in addition to the key.
You can have an authenticator as a backup to a Yubikey! Check out my Yubikey Backup video...
@@CrosstalkSolutions Thanks. I will do so when I get time.
Once at the office I was able to setup my Yubikey with the more secure office 365. I have 2 different office 365 accounts from work because my employer is both a university and a large hospital system. I work for the university doing medical imaging research for the hospital system.
Respect and reverence (in Russian uvazuha) to you for this informative video!
Excellent tutorial video, Chris !!! I would love to see some more to cover other online services (email and others) that can use these security keys. 🙂🙂🙂
I did this last year because people keep trying to break into my Gmail account for some reason and my Microsoft account. This pretty much put a stop to it especially my Gmail because my account is an original beta account and is very old, I think people want my alias for Gmail.
Hey Chris! Great and useful video to increase security by Yubikeys. Got my pair yesterday! Will follow your steps! Thanks and please produce more interesting vids ! 👍💪
Apple finally added NFC for Yubikey in 2019, and Android had it for years.... I was at Gartner IAM in Vegas in a meeting with yubico execs to bring them into my company as a security key provider when apple announced it. Everyone jumped up and celebrated over the news. Until then, Apple ONLY allowed NFC to be used with APPLE devices. I believe whole heartedly in FIDO and U2F and pushed to bring them into my company I work for as a Sr Lead Cyber Security Architect/Manager and was able to succeed. I use my Yubikey for all my accounts security and paired with LastPass where my Yubikey is the key to unlock my vault too where i have thousands of accounts stored and extremely secure passwords that I rotate every 90 days.... Not letting anyone in my world.
I am set on using hardware keys (also removing mobile numbers in ALL of my online accounts) because the Philippine government (I am currently living in the Philippines) recently enacted mandatory registration of prepaid SIM cards.
Or better don't use google services and secure other services with it.
...ok, that makes no sense to write this on youtube ;-D
Good advice and thanks for all the good videos. Watching since years, but I think i never wrote a comment.
What I really appreciate is that you do follow ups for many things!
Exactly my point of my comment. Unique identifier on yubikey and giving that to G, No thanks. Other services and uses a maybe.
@@BrewedIt Yes and no. Securing your services is always a good idea. Degoogling a bit is also something good.
I never thought if the yubikey could be used to track someone, that is a thing I need to search for. If yes: it's to decide how valuable your googleaccount is. Enough to secure it otherwise or enough to buy more yubikeys or similar.
And for degoogling: I think here it is about not to try completely go away, but in steps. E.g. there is not only gmail out there. Other search enginges could be useful, too. And a bit more competition could make some googleservices more userfriendly.
But that idea with tracking because of the yubikey is interesting. I really need to research it.
(Or wait a few weeks and Chris takes on this topic? ;-) ).
However, thank you very much for this point I'm gonna to look after.
In fact I just received yubikeys two days ago but haven't set them up.
ممكن الاستفادة منه
I'm trying to find out if the "flipper zero" can emulate a yubikey (as i heard the flipper zero can copy and emulate any thing that uses wifi bluetooth or nfc) and let someone use the flipper zero to access your yubikey locked account
2:20 it defaults to Google authenticator and has no other options listed.
Curious how you use three different Yubikeys. I understand the best practice of primary and backup, but how do you use three in your daily life?
I've put off moving from TOTP 2FA to U2F forever; thanks for the video to get me to finally order them.
Most people will only ever need 2 but for Chris specifically he’s got his company so it’s a bit different. It might be 1 for him, 1 for the second in command or the office, and 1 as a backup in a secure place. He’s talked about keeping 1 secure in a safe or bank before. Also it could be more than 3 as maybe each employee that needs access to the account gets one.
The only problem is with the Google id/pwd you can disable 2FA. It is a huge vulnerability. They should require the key to be touched before allowing it to be disabled.
I am finding a lot of good information on how to use a yubikey once it has been properly set up and activated, But i am not finding a lot of useful information on how to actually set one up and activate it... Any Suggestions???
I'm not sure if I did it right. For some reason, can only asked for my key one time. Unless I'm logging in into a new computer. Is that how it's supposed to be?
It asked me to create a pin? Also whenever I sign in for Google it's not asking for my yubico.
My Google account has an existing Yubikey registered and now I want to add a second key, but it seems Google changed the settings now it says "Passkeys and security keys" and it shows the existing security key but only shows the option to create 'Passkeys' not to add an additional security key. Is it still possible add security keys at Google?
Can you show us this using the flipper? The flipper does the nfc authentication on the smartphone?
thanks a lot for this great video!!
But what about in the context of an office, I have multiple persons (let's say 4 in this example) wanting to sign in to a Google account from their office devices (6 laptops, 2 desktops, 1 tablet, 8 phones), how should I buy 4 Yubikeys and then register them in Google?
I don't seem to have option to add other YubiKey. I don't have "+ Add security key" as a option under the key I have already set up. Please help
Why do google need to see the make and model of the key? Is there any way to bypass this on Windows? My friend on Linux could just select "no" and still get the key working.
Thanks yu ❤️
YubiKeys are awesome! I have several, I’m considering buying the YubiKeys FIPS keys in future. I have been using Authy 2FA and YubiKeys.
I currently use Google Authenticator. Is it possible to keep that until Yubikey is installed and up & running. And THEN disable and delete Goggle authenticator?
so should we have 2 keys just in case or will one key and backup codes work fine ?
Should we switch off 2 step verification after adding Yubikey ? And leave only that key? thx - maybe i miss that my English is like it is... thank you great content
Thanks!
Is that the same camo key that you used on apple iPhone maybe better question can you use the same key on different devices ty
Ever since "the video" I look at the background very carefully to see if you post another qr code lol.
Hey Chris thanks for another great Video. I did see this when it came out but just now set up my YubiKeys on my Google account. I did set up my YubiKey on Google using OTP. Now that I set up the physical key can I remove the OTP or leave it setup?
Should always uncheck remember this device, in using u2f the last 2 years
I have added 2, but it only shows 1 key in the list. When I try to re-add the other, it says “sorry this device has already been registered.” I wonder why they don’t both show up?
Do you have to setup Yubikey separately in Windows, iPad and Android phone as I use Gmail on all three platforms?
If I set up some accounts on my desktop computer with a Yubikey USB-A device won't I be locked out of accessing those accounts on my iPad? If so, is it possible to buy a Yubikey with a lightning connector and add it to the existing Yubikey 2FA methods? I'm a little confused on how this will work since I will be locked out of accessing the accounts on the iPad.
I have doubt for single key how many accounts can be used
What do you think of v6 of the Yubico Authenticator Desktop App?... on the Mac, it no longer lives in the menubar and doesn't automatically copy the OTP after touching the key.
Should I also setup the key for my passkey vs the 2step key?
8:29 ¹ @crosstalk solutions this b/c you didn’t “unselect” don’t ask again for this device on your phone or PC; assuming that means won’t need to use the “Key” again?
If that’s the case, the security is back to where it was or no; and also, if do forget to unselect that box…..how to you go into settings and clear out “saved devices”?
Thx for this how to vid, dry useful and like that the key is also nfc for basically anything as laptops now support nfc; which also begs the question….is nfc secure enough to be using?
Cheers✌🏻
¹ edited cuz forgot the time stamp, OPPSY
Can the finger print be used/transferred/leaked as a means to identify you and connect you as the owner to your mail account online or does the finger print information stay within the hardware mechanism of the yubico key itself?
I am finding a lot of good information on how to use a yubikey once it has been properly set up and activated, But i am not finding a lot of useful information on how to actually set one up and activate it... Any Suggestions???
should i deactivate the possibility to login by using my phone and granting access? i login with email + pw and then there comes a popup on my phone which i can press yes and then i am logged in even though i have a yubikey
3:24 It is at that point that all fails. After inserting the key, it asks me to enter my security key PIN ??? What to do ?
Chris, I get U2F using a Yubikey is better than OTP. But can the NFC data from the Yubikey be acquired and used for access, by using something like the Flipper Zero or another device?
No it can not - the Flipper Zero can't read the cryptographic key that comes along with stronger NFC cards like the Yubikey.
Im using Keepass on Win 10. And Keepass2Android on my Samsung.
Database is on a Server...
Can i use the same Database from Win10 and my Samsung with a Yubikey?
Not ordered 1 or 2 yet.
The Yubikey is not a password manager. It can however be used to secure your password managers.
I've had 2FA on for the last 3 months, and it's never asked for my Yubikey.
Why yubikey when we have smartphone?
I use OTP on yubikey with backup on a fidesmo card using an authenticator app.. So unless they can mind control me to run the app and read the card, they ain't phishing anything.
*phishing
@@CrosstalkSolutions I blame autocorrect. :D
Why did you leave the "Don't ask again on this device?" box checked on both of your devices? Doesn't that defeat the purpose of having all that security?
I think that once Google is "installed", one trusts one's device (e.g. face Id) to control access.
Is there a way to see what U2F keys are on a Yubikey? I have multiple Yubikeys like you and can't remember if all my accounts are registered to all the keys. Could not find anything online.
No - not that I'm aware of.
that's not a purpose of yubikey. The power comes with passkeys and unfortunately, yubikey doesn't work with multi google accounts.
hi chris, Im trying to setup all the tp link hardware you showed in your previous videos but the DHCP authentication does not accept my ISP DHCP 60,61 request. The archer VR2100 can but this means having to purchase another router just to have the tp ER605 connect. I know there is no way around this so what method would you use?
Ive been told i can change the subnet but by doing this i will get double NAT and some people still do this and no issues with their connectivity. I need your help!
I am finding a lot of good information on how to use a yubikey once it has been properly set up and activated, But i am not finding a lot of useful information on how to actually set one up and activate it... Any Suggestions???
Keney ke selam do asme
Is it recommended that you add both the two keys to the account or is there a way to copy the first key seed (5NFC) and paste it into the second key (5CI) using the Yubikey software?
It can be done but it's difficult.
@@LionRoars918 thanks for the reply! Sounds easier to just add them separately then so they are more isolated and that way you can simply remove them individually if one was ever lost.
@@HoldenRiot I had to use DOS software as the Yubikey windows software would not do it. My keys are identical except for the SN.
@@LionRoars918 oh wow. Interesting! I’m surprised their software doesn’t allow for that yet. Good to know though, thanks!
I show three yubikeys registered on my google account but I’m not prompted at login. Maybe I selected ‘trust this device’ or maybe have a SMS number listed too? Shouldn’t it ask on reboot, or when I open a google browser page? Or maybe I had google remember the password, and that bypasses U2F? Any pro tip to engage U2F? What are the instances where U2F will not engage? Also will it work with the iOS gmail app on my iPad?
If someone else tries to access your account they will be prompted, that is the important part.
I'm also having the same issue. Is it supposed to prompt up every time you log in or only to a new device that's not register in your Google account?
What's that flashing thing in the background?
JBL Pulse 3 bluetooth speaker. I have the Pulse 4 as well - great speakers!
Does the camo make it invisible? :]
Yea - I can never find the damn thing.
Good video. However the serial or unique ID of your yubikey is something in the dark corner as to speak, that can be attributed to you. For those that like privacy it's another discussion all together.
Interesting that your painting on the wall is to UK colour code and not to the US. Or B instead of A depending on how you interpret it. Looks cool either way.
T568B is pretty standard in the US.
Is any info transmitted "home"? Anyone watch the packets? Sure , "checking for updates" every day is really "necessary", like Logitech garbage. Anyone not so gullible really checked?
Semoga hak saya bsh kembali.
Yubikeys are good, but if you've got a Mac with Touch ID on its keyboard then that's actually a very good alternative. Possibly better, as it checks your fingerprint whereas Yubikeys will work with anyone's finger. Either way, Mac users have built-in support for U2F for 2FA.
There's the newer yubi keys which support biometric fingerprint, not just touch the sensor area. Think its v5 or something.
@@BrewedIt you’re right, the yubikey 5 bio. There’s no NFC version of them yet though. Anyway my point was that Touch ID is a very good substitute.
But Touch Id doesn't stop a random person from logging in to your Gmail if they have your password and have hacked your phone - it only controls access to your device.
@@GiveMeAnOKUsername no, you can store certain things (eg WebAuthn/passkeys) in the iPhone's Secure Enclave and these can only be accessed using Touch ID. If you know of a way to breach the Secure Enclave then I'm sure Apple would love to talk to you and pay you a huge bug bounty.
Until you need to log in to a system that blocks USB.
This is pretty unrealistic. An admin typically wouldn't both require U2F and also block USB. That would be dumb.
And if you're trying to log into a U2F protected account from a kiosk computer or any device that doesn't have or blocks USB - then yes...you're out of luck. But again - unrealistic scenario.
@@CrosstalkSolutions would using USB yubikey then inherently reduce the security of the system by allowing end users to insert random USB sticks onto a corporate network connected device?
Is there a tradeoff here?
@@CrosstalkSolutions we have admins who are looking to block USB mass storage devices. It is not clear if it'll block U2F keys too. Sounds like it could be a bit of an own goal :-)
It's also a problem if you are remoted into a system. For instance I RDP into my VM everyday for work and if I launch a browser on that machine and try to log in to an account I wouldn't be able to use my Yubikey. I've kept OTP on my Google account for that reason. I don't really see an easy way around it.
@@zachrose The yubikey works over vpn/rdp in a browser inside the rdp session.
Just hate how the yubikey is built, have broke 5 in less than a year, I need to have then with me whole time
What do you have a combine in your pocket? Lol…I’ve had one on my keychain in my pocket for 3 years and it’s fine.
@@CrosstalkSolutions I have tools and keys and other crap in my pockets so it is an hard environment there
such a joke to use Gmail as a private email server🤣
What else is there?
It's a shame Protonmail still doesn't support this.