Are You Ready for Hardware Security Keys?

i was interested right up to the point you said, "the google store"...there's an untold reason for everything google does!!!

I got a Yubikey 4 for free with a Wired magazine subscription. I now have 5. I bought them direct from Yubico and keep others as spares. I use it to log onto Lastpass, Google and Microsoft. Windows 10 also allows use of a Yubikey to log onto my laptop. One of my keys is a Yubikey 5 Nano that fits into the USB-C port on my laptop. I no longer need to keep my phone nearby to use authenticator apps or SMS codes. Convenient and easy to use.

Not supporting the murderer McAfee for sure.

I've had a Yubikey for at least 2 or 3 years. Actually I think I have about 3 of them. I don't use them. They seemed very complicated as I remember and they are a pain in the butt to use.

And what do these things do to keep the hackers out of the servers at the other end?

Dumb question - what happens if you lose the key? can anyone else use it ?

These hardware "security" keys seem especially insecure to me, since they can be lost, stolen, or simply taken from us, if we're robbed, and then the new owner both has access to our devices and knows whose devices they go with. Using a password manager seems a lot safer to me than an external product anyone might get access to. The idea sounds good on paper, but not so much in reality. Plus, it's one more "thing" to keep track of.

Not that lazy. No cell phone, smartphone, whatever.

Is it a pain in the butt remembering a million different passwords? Heck yes, But I'm not paying for security that Google, Facebook and every other tech manufacturer should automatically be providing.

Why is it up to only the consumer to provide security for their devices & information when these same companies harvest every bit of information they can from us due to their proprietary "lock" on their apps and devices?

Why is it after suffering unintended consequences of laxes in technology the only solution is to have the consumer pay more?

Here's my trade for them...you can have my info up to the point I can no longer stop you with MY preference settings using your products...you provide me with the protection of that information at no charge. You're already making bundles off of me.

The reason these security devices have not caught on is not because of cost, convenience or apathy to security concerns. It's because they don't advertise the products, and very few people have ever heard of them. I've never seen these devices for sale anywhere online. I don't know how they can even stay in business without proper marketing.

"...ten bucks that most people won’t spend to replace free passwords." Indeed! I use KeePass password manager. One secure password, several backups of my database on different devices, unique random and highly secure password (that not even I know) for each situation that requires one, no physical key that can be lost, stolen or have its circuits fried, and one copy of the database on a nano-USB on my key-ring. Once open on my computer it's one click to bring up the program, one to summon a login page and a third click to login.

KeePass is freely available for pretty much any platform, I need only one of the copies of my password database to access everything and it only took about an hour to go through all my old passwords changing them to things like jLzXd7OAHvMMUcVx6RQ7 — a once-only hour that everybody should spend whatever solution they choose.

Do I sound like an evangelist? Why would anybody pay for something that's inferior and more trouble?

What if I want to use my front door key but not unplug the device from my laptop - fail.
And it's yet another thing to lose, get nicked, break (waterproof, crushproof, been there, done that) - fail.

I got my Yubikey as an incentive to subscribe to Wired same way as Mark H. mentioned above. It sat around in its package for over a month until I had some time to figure out how to use it. It was easy and hard at the same time. Hard because I expected it to do more than it does. Easy because once I got it working, it requires no more effort except when I want to log into an account from a new device.

Some wrote here that they expect Google and others to keep them safe. I think Google does a great job (others not so much), but it's still ultimately up to me to avoid getting pwned.

The only thing I use my Yubikey for is keeping my Google account safe. Oh mighty Google! I had 2-factor turned on before using my mobile number, now my second factor is the hardware key. If someone hacks the info they keep about me, it does them no good without access to my key. At the outset it seemed like extra work, yet it's really not. And kinda fun too.

For those asking what happens if it's lost: 1) there is a method of recovery provided when setting it up, )2 nobody else can use it without knowing your account information to start with. Very unlikely.

I'm keeping the Yubikey and letting the Wired subscription go. Bob does a much better job collating and commenting than they do imho.

Back in the 1980s, every software vendor had a dongle (hardware key); some had 1 for each software product (e.g. 1 for Excel, 1 for Word, etc.) Many dongles could be connected in series; some NOT - a real pain. One firm I worked for had at least 10 dongles per workstation. So they bought dongle towers. The tower connected to a special port and had up to 24 slots (1 per dongle). Worked really great until someone stole the towers - dongles and all. We had to wait from 3 days to a month to get replacements. Why hardware dongles went out of fashion!!!

I considered getting a Yubikey, bit then found it required a web browser that I don't use. I'll wait for compatibility with Apple's Safari and Mozilla's FireFox browsers.

None of those work with Firefox or browsers other than Chrome