That makes them a pretty hard sell for any workplace environment, but also makes them a significant security risk on-par with writing your passwords on a post-it note for anyone looking to burgle... Seems like 2FA is the future...
- The biggest threat almost all users face is in the form of remote attackers: password phishing, database leaks + password reuse, tricking users into installing malware, etc. Local attackers are so far down the list of concerns that, really, using unique passwords and storing them on Post-Its is, for most people, an improvement in security!
- Leaving a Yubikey in the computer is, in fact, the normal, intended mode of operation--that's why Yubico makes low-profile keys that you can just leave in your USB port. Yes, an attacker can just steal the key, but the key alone is insufficient to authenticate in most uses; almost all relying parties using keys that don't support user verification will also require a password.
- The article was about passkeys, not FIDO security keys. Subtle difference, but, importantly, passwordless authn using passkeys requires the authenticator to support "user verification" mode (like a PIN/screenlock/biometric).
I will point out that I explicitly called out 2FA as being necessary. And any of PIN/Biometric (not sure what screenlock is), seems like that 2nd factor to me. So if these are different things, then the rollout is going really rocky (on par with Wii vs. Wii U), and they should probably come up with a better naming schema.
I don't think very many people know what "security keys" or "FIDO" are, to be honest, so you're probably in the tiny part of the Venn diagram of people who a) know what those things are but b) don't know that they support user verification. ;)
I'm not sure what users you interact with most on a regular basis, but for a pretty significant portion of the population, the most likely threats to their online (and offline) safety are jealous boyfriends/spouses/parents
Live in a house with a bunch of other people out of school? Extended family some of which you don't get along with in and out of the house a lot? Certainly for work stuff in an office. Probably not so much. The risk may not be that great in absolute terms but I'd absolutely think twice.
We're talking about somewhere around 65% of the overall population. Entirely ignoring women and children from your target market warrants a little condescention
May I humbly suggest you RTFM before posting FUD.
You can set a PIN on the Yubikey (or on the Yubikey Bio's, your fingerprint).
Further, the PIN will block after three failed attempts, requiring the PUK to reset the PIN.
Key loggers are of course defeated by the Yubikey's touch requirement (which you can make mandatory for all actions irrespective of time between actions, i.e. a no temporary cache policy).
Hence your "security risk" is non-existent.
You moved one of the factors.
The possible factors are: Something you know Something you are Something you have
Choose 2.
A PIN would be something you know A fingerprint would be something you are. The key is something you have.
I'm saying in the post that we're never going to just a passkey for this. And the yubikeys I have used in the past have all been just "something you have".
It only uses the keyboard in the OTP mode[1] (which you don't have to use, and you can even configure to completely disable). I guess OTP mode is probably the one you were thinking of ?
To be honest other than the Yubico demo website, I've never come across a resource in the wild that uses Yubikey OTP mode login anyway. :)
I'm not familiar with the technicalities of OTP mode but I'm guessing its resilient to replay attacks, so key loggers could still be limited that way.
For all other modes (PIV, FIDO, PGP) it doesn't.
I believe there is an option to store a static string in the Yubikey and replay that on-demand when you touch it ... but, well, I'd say you're on your own if you choose that option !
A company I worked at years ago used Pritunl as its VPN (which uses OpenVPN under the hood), with Yubico OTP configured.
It was a good-enough UX, and the user enrollment procedure downloads a certificate for connecting to OpenVPN which only works for one user, so when people inevitably spammed their Yubico OTPs into Slack, you couldn't use those to log in to the VPN as them since you wouldn't have their certificate.
A keylogger would probably be able to access the certificate. To get around that you'd need to do something completely out of band like acknowledge a push notification on an authenticator app on the user's phone.
I've seen it used in terminal applications.
I don't use either of them through choice though...
The problem these keys solve is that humans suck at managing passwords. Password managers are nice, but they're also protected by passwords, and humans suck at using those protective passwords.
I'm all for 2FA, but I'd like to see websites switch to key-then-password rather than password-then-key. Most people won't turn on 2FA and physical keys are a lot safer in today's world of leaked passwords galore than passwords.
If you don't enable 2FA and default to using a key, you can still do the whole "forgot password" (or rather, "lost my key") routine to reset your authentication through email.
Using a keylogger and then stealing the key will work but it requires a lot more than stealing a password