Security keys

What security keys are

Apple describes a security key as a small external device, like a thumb drive or tag, used to verify a sign-in. It works as a second factor after your password, or as a passkey that replaces the password.

• Phishing-resistant: CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication, and phishing-resistant MFA the gold standard.
• Tied to the real site: A WebAuthn key only offers credentials registered on the same website, so a lookalike page gets nothing.
• Device-bound passkeys: Passkeys saved on a security key stay on that key and cannot be synced to other devices.
• Beyond text codes: CISA lists SIM swaps and SS7 attacks among the ways codes sent by text or voice can be stolen.
• Proven at scale: Google told Krebs on Security that none of its 85,000+ employees had been phished on work accounts since it required keys in early 2017.
• Who makes them: Yubico, Google, Kensington, Thetis and Feitian; Apple names YubiKey and FEITIAN models as good examples.

How they work

When you register, the key creates a key pair and the site keeps the public half. At sign-in the key signs a challenge, and the site checks the signature with that public key.

• Private keys stay inside: The WebAuthn interface gives no direct access to the private keys on the key.
• A secure element: Google’s Titan uses a purpose-built secure element chip; Yubico lists a secure element in its keys.
• Insert and tap: You plug the key in and touch it; no battery or network connection is needed.
• NFC tap: Keys with NFC sign in on Android and iOS phones with a tap, no cable.
• PIN or fingerprint: A FIDO2 PIN protects the key; the YubiKey Bio uses a fingerprint, with the PIN as fallback.

Types

• FIDO-only keys: Yubico’s Security Key Series supports only FIDO2/WebAuthn and U2F and does not generate one-time codes.
• Multi-protocol keys: The YubiKey 5 Series adds smart card (PIV), OpenPGP, Yubico OTP and OATH codes.
• Biometric keys: The YubiKey Bio reads a fingerprint; the series has no NFC or nano version.
• Nano keys: The YubiKey 5C Nano is designed to stay plugged into your device.
• Dual-plug keys: Thetis’s PRO key folds out USB-A and USB-C; the YubiKey 5Ci pairs USB-C with Lightning.
• FIPS-validated keys: Yubico sells FIPS 140-2 and 140-3 versions for government and regulated organizations.
• Bluetooth keys: Google stopped selling Bluetooth Titan keys in August 2021.

What to look for

• FIDO Certified: Apple requires FIDO Certified keys; Yubico and Kensington keys are FIDO2 Level 2, the Thetis PRO Level 1.
• The right plug: USB-C works with iPhone 15 or later and most Macs; Lightning with iPhone 14 and earlier; USB-A with older Macs.
• NFC for phones: Apple says keys with both NFC and USB-C work with most Apple devices.
• Passkey slots: Storage varies: 100 on YubiKeys with firmware 5.7.4 or later, up to 250 on Titan, 50 on Kensington’s VeriMark NFC+.
• Firmware version: Yubico keys before firmware 5.7 carry the Infineon flaw in advisory YSA-2024-03; Yubico Authenticator shows the version.
• Code storage: A YubiKey 5 on firmware 5.7 holds 64 OATH seeds for authenticator codes.
• Built to last: Yubico keys are IP68 rated and crush resistant to 25 N·m, with no moving parts.

On the plane and on the trip

• Register two keys: Apple requires at least two keys, up to six, and suggests leaving one at home when you travel.
• Add the backup early: Google may hold a newly added key for 7 days before it works at sign-in.
• Keep it apart: XDA advises storing the key away from your laptop, so one theft does not take both.
• Set a PIN: XDA recommends a FIDO2 PIN on any key you take on the road.
• Recovery codes: Keep printed recovery codes somewhere that does not itself need the key to open.
• Security screening: XDA says X-rays and checkpoints are no concern; the keys have no battery and are IP68 water and dust resistant.
• Phone sign-in abroad: An NFC key signs in on an iPhone with a tap; USB-C keys plug into iPhone 15 or later.

Limits and care

• Lose them all: Apple warns that losing every trusted device and key can lock you out of your account permanently.
• Storage fills up: Kensington’s VeriMark NFC+ holds 50 passkeys and cannot delete one without a full reset.
• No replacement program: Yubico offers none for YSA-2024-03; an attack needs the key in hand and specialized equipment.
• Not everywhere: Apple Account keys do not work for child accounts, Managed Apple Accounts or older devices.
• Temperature range: Yubico rates its keys for use at 0–40 °C (32–104 °F) and storage at −20–85 °C.
• If it gets wet: XDA says let a key dry fully before plugging it in.

A short history

Yubico was founded in Stockholm in 2007 and showed the first YubiKey at the RSA Conference in April 2008. In 2012 Google and Yubico began work on the U2F standard, with help from NXP.

• February 2013: The FIDO Alliance launches to reduce the world’s reliance on passwords.
• October 2014: U2F 1.0 is published; Yubico releases its FIDO U2F Security Key that year.
• 2018: Google introduces the Titan Security Key; Yubico’s new Security Key is its first with FIDO2.
• March 4, 2019: WebAuthn Level 1 becomes a W3C Recommendation; Level 2 follows on April 8, 2021.
• November 2023: Google launches new Titan keys with NFC on both models and room for 250 passkeys.
• May 2024: Yubico ships firmware 5.7; YSA-2024-03 on the Infineon flaw follows in September.