You Should Be Using Yubikeys!

I freakin' love Yubikeys. I switched to Yubikeys from Google Authenticator about a year ago, and I will never go back. Not only are they great for TOTP 2FA, but they do so much more! In this video, I try to cover it all, and probably screw up a few facts - but oh well - that's not the point. The point is - you should be using Yubikeys.

Product links (Amazon affiliate):

Timecodes:
00:00 - Intro
02:18 - What are Yubikeys?
02:56 - What is 2FA?
04:40 - TOTP 2FA and Authenticator apps
06:12 - Why you should standardize on hardware security keys
06:47 - Why hardware keys are faster than authenticator apps
08:05 - Yubikey authentication beyond TOTP
08:30 - FIDO authentication
12:07 - Yubikey TOTP login example
13:00 - Yubico Authenticator overview
13:39 - Yubico Authenticator on iPhone example
14:32 - Yubikey U2F login examples
16:09 - Yubikey WebAuthn login example
16:31 - Yubikey Initial Setup
18:00 - Adding a TOTP token to Yubikey
19:51 - Adding TOTP tokens to multiple Yubikeys
22:51 - What if you lose your Yubikey?
25:17 - Adding a FIDO U2F token to Yubikey
28:37 - Using Yubikey for Windows Login
30:44 - Will the Yubikey work for any TOTP 2FA?
31:48 - Different Yubikeys available

----------------------

Follow me on Twitter: @crosstalksol

Connect with Chris:
Twitter: @CrosstalkSol

[stevenhatcher]

Just ran across this video... All I can say is THANK YOU! You did an amazing job at laying out what Yubikeys not only are, but the demos were off the chain! Keep up the great work sir!

[grantrettke]

Best balance between skimming over details to make it short and going way over time to make an exhaustive yet way too long video. Key points are covered. Points out of scope are stated as such. Points that have bigger implications and do need consideration at some point, are also made clear: things that make you think. Ideal balancing a critical yet confusing topic. Great vid.

[mikeoreilly]

I've always found Ubikey's own documentation to be fairly obtuse. Thanks for the clearest explanation yet.

[APrintmaker]

Very useful. I too had Yubikeys on hand waiting to understand how to use them. Multiple keys per account info helped alot.

[obiwan]

For your time codes to automatically put "chapters" on your timeline, you have to put a 0:00 time code in the list. Great video!

[rexjuggler]

We have company issued Yubikeys for over 5 years and you are exactly right about how good they are. Even though I'm a very long time user, I am so glad you made this video. I have actually been wanting to use Yubikeys for my personal accounts, but hadn't invested the time to figure out how to set it up. So I've been using the MS and Google authenticators. But I prefer the yuibikey for the same reasons you cited. I was working in Germany a couple years ago and forgot my yubikey at home and needed access to our corporate VPN. We fortunately had an office a couple hours away and I was able to get a replacement through our IT. But I wasn't sure if I could setup a couple so I'd have a backup. I also wasn't sure about how to get it to work with a phone since my company issued yubikey is the USB A style. You really answered ALL my questions. I'm going to hit your link and pick up a few.

[cbrunnkvist]

"Scanning" the desktop screen by the desktop app is a pretty neat little usability hack! I haven't been using the app but now I'm sold on it 🤓

[paulrobertmarino]

For TOTP you can use the QR code to program multiple Yubikeys simply program one and do not put the code from the key into the site, then insert your second one and add it there two and once you've programed the last one then enter the code into the site. As an alternative for having multiple keys for TOTP you may copy the code or QR image and store it in an encrypted file using tools like GPG/OpenPGP but that is an other subject, sort of... it would have been nice to cover the PGP functions of the Yubikey as well, may be that can be a future video :).

[AmichaiRotman]

You don't have to use the manual method to configure the same TOTP on all your YubiKeys, just switch between them while on the QR Code screen and enter the TOTP from the last key you configure to finish the respective service TOTP setup.

[adamkee]

Now, this is neat. I never know those accounts are stored in the keys. I started using Authy last year because it can back-up my keys. But that means my secret codes are now on the cloud. I need that feature so I won't lose them whenever I reset my phone, which I do every time when it gets a major system upgrade. I don't lose my stuff easily, so having a key is better than having an app. Thank you for such an informative video.

[VirgilNicolae]

Thanks, Chris! Using them already for about 3 years but managed to find some new things watching your video!

[carlode]

Thank you for your thorough summary of Yubikeys and set up. Bravo!!

[jonathanshaw]

Regarding Tile, they work via bluetooth not GPS, so they will only give their location if they are near your phone (or near someone else's phone with the tile app). It works well for if you can't find your keys in your house or to check they're in a bag, much less useful for tracking a stolen bike.

[sdiggly]

Wow, great video! Extremely informative, very well edited. This was exactly what I needed, thank you!

[donovansobrero]

been using a yubikey for years have a few of them. it's important to note if you set everything and then loss the key your going to have a problem. So its best to have two 1 you use and one you keep in a safe place with the same sites configured on it.

[iThinkergoiMac]

Great video! It's worth noting that for most accounts, even if you miss typing in the code before it expires, as long as you know it, you can still enter it for some time (usually between 5 and 15 minutes). Obviously, as soon as it expires you can't see it anymore, but if you still remember it, you can still enter it.

[Mopki]

I purchased 5 NFC and 5C NFC. I'm ready to set them up now that I lost my job.
I wish I found you before and used your link. Great video!

[mdkv]

Funny, I just finished setting mine up last night! Ordered two more for my parents.

[azclaimjumper]

I now have my two 5NFC YubiKeys "Smart-Card Enabled" on both of my Macs meaning that the only way I can log onto either computer is to physically insert the Key into a USB port & enter the PIN. Passwords no longer work.
Pairing my keys to each computer was easy peasy. Getting the "Smart-Card Enabled" on my computers required the same effort Generals in WWII had in planning the D Day invasion. Apple articles are incomplete & I never did find or talk with a Senior Tech Advisor that had ever even dealt with the codes required that need to be entered in Terminal.
Either Passwords or the YubiKey can be used to log into a computer if "Smart-Card Enabled" isn't enabled which seems to me to defeat the purpose of YubiKeys.
Yes, I've just subscribed & rang the notification bell.
Warm Regards from Reno, Nevada.

[dennisvanlith]

I absolutely love my YubiKey. The only downfall is the lack of support on many sites and web apps on the u2f protocol. I have tried many times to push these hardware keys on UniFi, Synology or others. But they rarely respond on the request, due to lack of the user base usage. The more people keep asking for these requests. The faster it will be taken into consideration.