5 ms·

I tried the quiz to get a recommendation but it finishes in an endless loop > learn more > quiz starts again https://www.yubico.com/quiz/ https://www.yubico.co

I tried the quiz to get a recommendation but it finishes in an endless loop > learn more > quiz starts again https://www.yubico.com/quiz/ https://www.yubico.com/quiz/ Also can anyone explain the multiple models too me? https://www.yubico.com/products/yubikey-hardware/ https://www.yubico.com/products/yubikey-hardware/ Say I want an USB-A key, I can choose from three and they all have different prices. The Security Keys are less secure than a FIPS or a 5? Maybe I'm just too end user but the multiple choices to me are the exact opposite of the easy to use principle. The whole product page is just confusing.

pja 7y ago
It’s not entirely obvious from the description, but the main difference is (I believe) that the cheap keys can only do FIDO 2-factor authentication whereas the expensive ones have secure storage so you do things like putting your pgp private keys on them. If all you want is true 2-factor authentication for Gmail / Facebook / Github etc then the cheap keys are exactly what you need.
munchbunny 7y ago
Short version: the FIPS is for enterprise. The Security Key is for consumers. The 5 series is for enterprise or power users. This might be more useful for you: https://www.yubico.com/products/yubikey-hardware/compare-products-series/ https://www.yubico.com/products/yubikey-hardware/compare-pro... You want the Yubikey FIPS if you're using it in a context where FIPS compliance matters, such as US government. If not (such as for personal use), then don't bother. The Security Key series is the budget minimal "works as a FIDO authenticator". It lacks the bells and whistles that come with the 5 series. AFAIK it is not "less secure," it just lacks bells and whistles. The 5 series works as a FIDO authenticator, but it also includes PIV capabilities (smartcards, PGP, etc.), which allow you to do stuff like this: https://developers.yubico.com/PGP/SSH_authentication/.* https://developers.yubico.com/PGP/SSH_authentication/.* The PIV capabilities matter more in the context of enterprise/government applications where smartcards have been in common use as a 2nd factor for many years, which makes having an all-in-one smartcard+FIDO device very convenient. * Caveat: I recommend against using your Yubikey for SSH private/public key authentication unless your SSH setup also requires a password. Single physical factor is worse than having a password protected key pair in your ~/.ssh folder.
- haunter 7y ago
  Thank you so much that was really useful!
- polack 7y ago
  The Yubikey requires a password by default to use the ssh key stored on it and it will lock itself after 3 failed attempts. So I don’t think your caveat is valid. I rather have my encryption key on hardware design to keep anyone who finds it from brute forcing it than just password protected on a hard drive.
  - munchbunny 7y ago
    Yup you're right, I mixed up the PIV behavior with specifics around FIDO2 vs. U2F PIN policies.
  - LIV2 7y ago
    It can also be configured to require a touch for every signing action or even one for multiple signing actions within a 15 second window I think it is
deleted 7y ago
[deleted]

pja 7y ago

It’s not entirely obvious from the description, but the main difference is (I believe) that the cheap keys can only do FIDO 2-factor authentication whereas the expensive ones have secure storage so you do things like putting your pgp private keys on them. If all you want is true 2-factor authentication for Gmail / Facebook / Github etc then the cheap keys are exactly what you need.

munchbunny 7y ago

Short version: the FIPS is for enterprise. The Security Key is for consumers. The 5 series is for enterprise or power users. This might be more useful for you: https://www.yubico.com/products/yubikey-hardware/compare-products-series/ https://www.yubico.com/products/yubikey-hardware/compare-pro... You want the Yubikey FIPS if you're using it in a context where FIPS compliance matters, such as US government. If not (such as for personal use), then don't bother. The Security Key series is the budget minimal "works as a FIDO authenticator". It lacks the bells and whistles that come with the 5 series. AFAIK it is not "less secure," it just lacks bells and whistles. The 5 series works as a FIDO authenticator, but it also includes PIV capabilities (smartcards, PGP, etc.), which allow you to do stuff like this: https://developers.yubico.com/PGP/SSH_authentication/.* https://developers.yubico.com/PGP/SSH_authentication/.* The PIV capabilities matter more in the context of enterprise/government applications where smartcards have been in common use as a 2nd factor for many years, which makes having an all-in-one smartcard+FIDO device very convenient. * Caveat: I recommend against using your Yubikey for SSH private/public key authentication unless your SSH setup also requires a password. Single physical factor is worse than having a password protected key pair in your ~/.ssh folder.

haunter 7y ago
Thank you so much that was really useful!
polack 7y ago
The Yubikey requires a password by default to use the ssh key stored on it and it will lock itself after 3 failed attempts. So I don’t think your caveat is valid. I rather have my encryption key on hardware design to keep anyone who finds it from brute forcing it than just password protected on a hard drive.
- munchbunny 7y ago
  Yup you're right, I mixed up the PIV behavior with specifics around FIDO2 vs. U2F PIN policies.
- LIV2 7y ago
  It can also be configured to require a touch for every signing action or even one for multiple signing actions within a 15 second window I think it is

deleted 7y ago

[deleted]