While I could have made some of those explanations simpler, I really wanted to lay down some of the inner workings of the key enough to make what it can and can't do clear, which can be hard to boil down into making it simple (let alone short, I'll be the first to say I really went overboard with how long this turned out to be). Since I'm partly writing these notes for myself, there might be some back and forth between 'explain like I'm five' and 'I'll asume you have a minor in computer science'. Now that I have one, I decided to write down everything I figured out in order to help myself (and hopefully some other people reading this) make sense of all this.

The official documentation tends to be surprisingly convoluted at times, weirdly organized and oddly shy about a few of the limitations of these keys (which I'm making a point of putting front and center).

So while looking for information on security keys before getting one myself, I got very confused reading about all the different modes and advertised features of Yubikeys and other similar dongles. (EDIT: Besides Reddit, I've also put this up on Github Gist) These credentials are not shared across services, are resistant to phishing & replay attacks, and with the correct architecture resistant to MiTM attacks.'What the heck is a Yubikey and why did I buy one?': A user guide With these new capabilities, the YubiKey enables the replacement of weak username/password credentials with strong hardware-backed cryptographic key pair credentials. FIDO2 offers expanded authentication options including strong single factor (passwordless), two factor, and multi-factor authentication. CTAP is an application layer protocol used for communication between a client (browser) or a platform (operating system) with an external authenticator such as the YubiKey 5 Series, and the Security Key Series by Yubico. Yubico is a core contributor to the FIDO2 open authentication protocol.įIDO2 is the evolution of FIDO U2F, and offers the same improved level of security based on public key cryptography. FIDO2 is an open authentication standard, hosted by the FIDO Alliance, that consists of the W3C Web Authentication specification (WebAuthn API), and the Client to Authentication Protocol (CTAP).

Yubikey 4 fido2