We discussed some weeks ago that using an authenticator app is a more secure method of multi-factor authentication than SMS or email. An even more secure option is using a physical security key, such as a YubiKey. For anybody unfamiliar with security keys, they are small devices, which you insert into a USB port (or in some cases tap against your mobile device) to verify your identity when logging in.
To be clear, there are other brands of security keys, such as the Titan Security Key from Google. I’ll be referring to YubiKeys in this article though simply because that’s what I’m most familiar with.
With multi-factor authentication via email, SMS, or authenticator app, a major threat is that the user can be tricked into giving the multi-factor authentication code to a malicious party.
Another threat with such multi-factor options is the possibility of the code being somehow intercepted (e.g., through SIM swap fraud, as we’ve discussed).
If you have an account for which the only way to log in is with a physical security key, those types of threats are largely eliminated. For a malicious party who is not able to get physical possession of your security key (i.e., almost any remote threat actor), their menu of options for trying to access your accounts is dramatically reduced.
User Experience
The user experience with a security key is going to vary from one website to another. In part that’s because there are, broadly, two different ways in which a security key can be used to log in.
Firstly, there’s the traditional/older method, in which you’d still use a username and password, and the security key would be your method of multi-factor authentication. If using your security key in this manner, to log into a website you would:
- Enter your username and password,
- Connect your security key to your device, then touch the key to activate it.
But security keys (at least modern ones) can also be used for passwordless login (i.e., they can be used to store a passkey or similar FIDO2 credential). In that case, in order to log in you would:
- Enter your username or select an account, if prompted to do so,
- Connect your security key to your device,
- Touch the key to activate it and (if the website requires such) enter the security key’s PIN (discussed below).
With passkeys stored on a security key, you get all the various benefits of passkeys (i.e., phishing protection because they only work on the legitimate domain they were created for, no need for the institution to store a password, easier to use, etc.) and you make the passkeys themselves as secure as possible (i.e., making it as unlikely as possible for a malicious party to be able to use them).
Get More Than One!
If you’re going to use a security key for logging into anything, be sure to buy more than one. If you only have one, and you lose it or it gets damaged, you could be locked out of a bunch of important accounts — permanently in some cases.
Often, three (or possibly even more) is a good idea. One that you use regularly at home, another in a safe at home, and a third in a secure off-site location (e.g., safe deposit box at a bank). That way, even if the two at your home are destroyed (e.g., due to a fire or natural disaster), you still have a backup.
Set Up a PIN (via Yubico Authenticator App)
When using a key for passwordless login, many websites require you to verify yourself on the key (e.g., by entering a PIN). If you haven’t yet set a PIN, you’ll typically be prompted to create one the first time it’s needed.
Personally, after buying a YubiKey, I would encourage you to download the desktop Yubico Authenticator app, so that you can set a PIN (“FIDO2 PIN”) for your key as soon as it arrives at your home.
With regard to selecting a PIN, Yubico notes the following:
“For those combining a hardware authenticator with a PIN, it’s important to note that PINs do not demand the same security requirement as a password. A PIN and a password are different. Since a PIN is not part of the security context for remotely authenticating the user (the PIN is not sent over the network for verification), it can be much simpler and less complex than a password, and does not need to be changed with the same frequency (or at all).”
Point being, a PIN doesn’t need password-level complexity. (But still, don’t set it to 123456 or something quite so simple and guessable.)
Generally you’d want to set the same PIN on each of your keys, to reduce the likelihood of getting locked out in an emergency (e.g., you’ve lost your main key, go to the bank to get your backup key, and because it has a different PIN that you rarely use, you can’t remember it). The additional risk from using the same PIN on each is minimal. If a malicious party has one of the keys and has your PIN, the fact that it’s also the PIN to your other keys doesn’t make the situation any worse. Don’t give anybody else your security key or the PIN for your security key.
One last point about setting a PIN: when logging in with the PIN, you’re attempt-limited, for security’s sake (i.e., so that if somebody manages to get a hold of your key, they can’t simply try over and over to get the correct PIN). If you enter the incorrect PIN 3 times, you’ll have to remove and reconnect the key. After 8 incorrect attempts in a row, the key itself is locked. You don’t have to throw it away, but it will have to be factory reset, in which case all the passkeys stored on the device will be deleted.
Security Keys + Password Managers
When we discussed password managers, we also discussed the common “passwords in a physical notebook” approach to password management. The whole idea behind that approach is that it’s pretty unlikely that somebody is going to get into your house and steal that notebook. And that’s likely true. For most of us, our homes aren’t broken into on a regular basis.
But if you use a password manager and you secure your password manager account with a security key (i.e., your security key is required to log into your password manager), you still have that “somebody would have to steal this physical thing in order to access my passwords” -type of security. Plus, now they’d not only have to steal the physical thing, they’d also have to know the PIN to unlock the security key.
And in addition you get:
- Improved data integrity (i.e., no risk of a coffee spill destroying your record of passwords).
- Improved data availability (i.e., no need to remember to take the notebook with you when traveling).
- The anti-phishing security that results from the password manager not providing a password if you accidentally end up on a fake/malicious lookalike website.
- Secure password sharing for a family.
- The convenience of password auto-fill.
- A secure place to store backup codes for websites.
- A secure place to store fictional answers to “security” questions. (For example, for your auto insurer’s website, when they ask the name of your favorite food, you can store in the password manager that the required answer is “kCbc$A4qjmto4” rather than the true but quite guessable answer of “pizza.”)
What Happens if a Security Key is Stolen?
You should take the physical security of your security keys seriously. Treat them as if they were, very literally, the keys to your accounts. And if you lose one, you should promptly remove that key as a sign-in option from your various accounts (i.e., by signing in via some other method, navigating to your security/sign-in options, and removing the security key that is no longer in your possession).
That said, if one of your security keys is stolen, the thief will probably not be accessing all of your accounts immediately.
Firstly, a thief who has stolen your key would not know, for example, that the key could be used as the multi-factor option for your Vanguard account with username HotBob1972. Even with passkeys stored on the device, access to those credentials is typically gated by user verification (such as a PIN).
Secondly, to use the security key to log into an account, the thief would generally still need either your password (if you were using the key for traditional multi-factor authentication) or the key’s PIN (if you were using the key to store a passkey).
But again, keep those security keys secure (i.e., never give them to anybody else, always be aware of where they’re located rather than leaving them randomly lying around the house). And if you do lose one, promptly remove it as a sign-in option from your various accounts.
Security Key Limitations
Firstly, not all websites allow security keys as a multi-factor authentication method or for passwordless login.
Second, as always, your accounts are only as secure as the least-secure method of accessing the account.
An authenticator app is more secure than SMS or email as a multi-factor authentication method. And a security key is more secure than an authenticator app.
After setting up secure methods, you generally want to remove the less-secure methods of signing in, if the website allows you to do so. (Though again, be sure you have multiple options. If the only way to sign into an important account is with a single physical security key, you’re setting yourself up to be locked out of the account someday.)
Be sure to also examine the account-recovery process for each of your accounts (as distinct from the normal method for signing in). If it’s some insecure method (e.g., a phone call to your mobile phone), the account is still insecure.
Additional Reading
For readers who want additional reading, the following articles from Yubico (the company that makes YubiKeys) may be helpful:
Hi. I'm Mike Piper, the author of this blog. I'm 
