I’m a big fan of the using hardware keys for two
factor authentication.
You know the deal.
These little keys can be used to protect your online accounts from being taken over.
And that includes all your fav sites like Instagram, Gmail, Twitter, Facebook, Youtube,
and more.
But how does it do this?
Well, first, what is a hardware key?
And what is a Yubikey?
There’s a few different brands in this market that I trust, but Yubikey has a wonderful
variety so I’ll use theirs for today’s video.
I’ll focus on how you can use one of these for individual use - not for enterprise or
small business.
When you login to a website online, you have to type in your username and a password.
If you want another layer of protection, lots of websites these days allow you to turn on
another setting called two factor authentication or multi factor authentication.
This will require you to type in your username and password… but ALSO input a special code
that only you have access to, and that code changes every minute or so.
Codes are sent to you over text message, over email, or thru an app on your phone.
And if you don’t type in that code fast enough, you have to request a new code.
You’ve probably gotten text messages like this for your bank or credit card accounts
online - they send you a text that says “don’t share this with anyone, here is your login
code - 123456”.
Because these codes change and are random, they do add pretty strong security to your
accounts… but if someone was trying to log into your account and has access to your phone
number and could see your text messages, or if someone logged into your email account
or stole your phone - they could still steal those codes when they get sent to you.
2FA codes add an additional layer of security to online accounts but you have to protect
those codes because anyone can read them if they see them.
So that’s why Yubikeys exist - these protect you from those kind of phishing attacks because
there is no code.
Instead of needing to type in a code, you put in your username and password and plug
this physical device into your computer or smartphone.
Which, in the simplest way to describe it means a thief would need this physical key,
PLUS your username and password to steal your accounts.
If they guessed your username and password but they don’t have this key - they still
can’t get in.
Without getting really deep into “well, actuallys”, yes, there are ways an attacker
could get around 2FA, but since those issues usually stem from successful phishing attempts,
we’re going to move on.
Now you know what hardware keys do.
I often get questions about hardware keys that I want to debunk.
There’s a lot of skepticism about how a hardware key can protect you and why I’d
recommend you use one.
Let’s get into debunking some myths.
MYTH 1:
You can’t use 2FA if a site doesn’t accept a hardware token like yubikey.
Well, hopefully they give you the option to use 2FA codes for authentication and if that’s
the case, just enable that instead - I recommend receiving codes thru an APP over text messages
or email -
and DON’T share those codes with anyone.
Keep them secret, keep them safe.
Yubico does offer an app that they made themselves that you can use as well, and it’s kinda
of a workaround for these sites that don’t actually accept hardware keys.
See, instead of accepting a key, you would get a code from the Yubico app and protect
the yubico app with the key.
When you unlock the app, you can see the codes.
Here’s how it works:
First, log into the website where you want to set up 2FA, go into your settings for security,
and look for the option to enable 2FA.
Click on that, then choose to get codes sent to a authenticator app.
Paypal has added the option for a security key, but let's just say they haven't added
that yet for demo purposes.
On this next screen, you'll see a QR code.
Now jump over to the Yubico Authenticator App, and plug in your Yubikey.
On the Windows App, go up to the sandwich icon and click it and go to Authenticator.
To add an accound, click the three little dots and choose Scan QR Code.
Hopefully it sees the code on your screen, but if not, you can manually add the account
by clicking the three little dots and choosing Add Account.
Type a Name of the issuer, your account name, and the security key.
This security key is a code that is usually written out right underneath the QR code which
you can just copy and past into the Yubico Authenticator App.
Under that, you can require a touch on the key to unlock the codes, then click add account.
The account is now registered on that key.
In order to unlock the six digit code, I have to touch the key.
From there, I can copy and paste the code into the Paypal page to enable 2FA.
Now when I log in, that code will be required in order to access my paypal account.
The code changes every minute or so, and I can always update or remove the key from my
paypal account.
With the Yubico app, you can actually use your Yubikey to protect the codes that are
sent to your Yubikey.
The codes actually get stored on the key, and the app lets you read them because well,
this device doesn’t have a screen on it, so how else would you read the codes?
You read the code, type it into the website when it asks you to, of you copy and paste
it, and you log in.
The only way you can access those codes is if you have this specific key since those
codes are actually on this key.
MYTH 2:
You have to carry a hardware key with you everywhere 24/7.
No, you don’t.
Once you log into your devices, those devices remember you as long as you allow them to,
so you don’t have to use this to log in every time.
If you get a new phone - then yes, you’ll need to pull out the yubikey to log into your
accounts on your new device.
Every few months or so you may have to “re authorize” your yubikey as a trusted device
on your phone or laptop, but otherwise, no you won’t need to use it every time.
MYTH 3:
You need a different key for each and every account you have online, that gonna get expensive
fast!
No, you don’t.
You just need to buy one (though I recommend buying and setting up a backup in case you
lose your main Yubikey).
Yubikeys do have limits, but those limits are relatively high depending on the type
of 2FA the websites accept.
Can you set up more than one Yubikey per account?
Yes!
On most websites, they’ll allow you to set up your main hardware key AND set up a second
one as a backup.
What i do is set up my main one and then go back through the same process to set up a
backup one, then I store the backup key in a secret place that’s safe and secure in
the event anything happens to my main one.
MYTH 4:
If you lose your key, you’re screwed.
If it stops working, you’re screwed.
No!
Again, a lot of online accounts allow you to set up a backup system for logging in.
If you don’t want to set up a back up system, online accounts should also give you a few
special codes that you can copy and store away in case you lose your key.
Those codes are one time use codes though.
So if you’re setting up 2FA on your online account and the website suddenly shows you
a list of like 10 backup codes, print them, copy them over to a password manager, write
them down, whatever - just make sure you keep those codes stored safely somewhere in case
you lose your hardware key.
MYTH 5:
This won’t work for my accounts.
Well, this one is tricky, because there’s a bunch of different “protocols” websites
use with 2FA, and
when you go into your settings for your different accounts, the website will usually tell you
which protocols it uses in case you’re interested.
And practically all the popular ones do work with yubikeys.
Yubico even has a list on their website that you can check before you decide to buy one,
just to make EXTRA sure that they work with the websites you visit
most often.
This is why I recommend physical keys so much - because someone trying to break into your
account couldn’t do it remotely - from far away - they would legit need to know your
username and password, but would also need to steal this key from you.
And if that happened, you could always revoke the stolen keys access to block any attempts,
and just buy a new one or use a backup key in the meantime.
Revoking a key is as easy as hitting up the website on a computer or a phone that you’re
already logged into, going into your settings, finding security and 2FA settings, and deleting,
revoking, or removing the stolen or lost key.
Once you do that, you can change your 2FA options or switch to a new key.
And of course, if someone’s trying to steal your account, change your password as well.
I also find that using a key is a lot faster than waiting for a text message, an email,
or checking an app for a code.
You don’t have to type anything, you don’t have to remember a code, you just tap or plug
in and go.
With any of these, you have to unlock your phone and wait for the 2FA key to pop up or
open an app and find the matching account…
with a hardware token, you tap it or stick it in your machine.
There’s less steps involved.
I know that there’s a lot of hesitation around hardware keys because they seem convoluted
or like too much effort.
The biggest effort you’ll make is setting them up.
After that it’s smooth sailing and you’re more protected.
You no longer are the low hanging fruit for an attacker.
What other myths have you seen about hardware keys used for two factor authentication?
I do have a direct affiliate link down below to purchase one of these keys and that does
help support the channel but costs no extra to you if you were gonna buy one anyway.
But otherwise, just consider it.
I have many of these that I’ve bought over the years and I love them because I find they
are more convenient than 2fa codes.
Tell me about your experiences with hardware keys below.
I’ll do some more videos about them in the near future, so subscribe and look for those
soon.
Bye, yall!