Tech Solvency / MFA / Security keys / YubiKeys

YubiKeys

What is a YubiKey?

A YubiKey is a kind of security key made by Yubico, the first major innovator in the space.

Tips

• If you don't remember your YubiKey per-key PIN, you can reset it with the YubiKey Manager (but note that all existing credentials will be reset!)
• Multiple keys look alike. You can use a Sharpie, labeler, or pick a personalized sticker for your YubiKey

Integrations

Many YubiKey integrations are listed and explained in Yubico's Works with YubiKey catalog.

The list can be narrowed down based on what key you have, what protocol is supported, etc. For example, you can see all apps supported by the Security Key NFC.

Here is a selected list of integrations - those supporting FIDO2/WebAuthn or U2F (so, all Yubico Security Keys and YubiKeys)

• 1Password
  • Yubico guide
  • 1Password guide
• AWS
  • Yubico guide
  • AWS blog
• Bank of America
  • Bank of America FAQ
  • NOTE: only two keys allowed; must call support to get an authorization code to add a key; add both keys during the same call to save time
• Bitbucket (cloud)
  • Yubico guide
• Bitfinex
  • Bitfinex guide
• Bitwarden
  • Bitwarden guide
• Boxcryptor
  • Boxcryptor guide
• Cloudflare
  • Cloudflare guide
• Coinbase
  • Coinbase guide
• Dashlane (Premium and Business only)
  • Yubico guide - Premium
  • Yubico guide - Business
• Digicert
  • No public howtos for individual use, but they are supported (2021-10)
• Dmarcian
  • Dmarcian guide
• Dropbox
  • Yubico guide - Dropbox Personal
  • Yubico guide - Dropbox Business
• Duo
  • Yubico guide
  • Duo guide
• Facebook
  • Yubico guide
  • Facebook guide
• FastMail
  • Yubico guide
  • Fastmail guide
• Files.com
  • Files.com overview
• Gandi
  • Yubico guide
  • Gandi guide
• Gemini
  • Gemini overview
• GitHub
  • Yubico guide
  • GitHub guide
• GitLab
  • Yubico guide
  • GitLab guide
• Gluu
  • Gluu guide
• GoDaddy
  • Yubico guide
  • GoDaddy guide
• Google (including YouTube, GMail, etc.)
  • Yubico guide
  • Google guide
• Hey
  • Yubico guide
• ID.me
  • No public howtos for individual use, but they are supported (2021-10)
• Keeper
  • Keeper blog post
• Login.gov
  • Yubico guide
  • Login.gov guide
• Mail.de
  • Mail.de guide
• MaxMind
  • MaxMind guide
• Microsoft / Outlook / M365
  • Yubico guide
  • NOTE: Only passwordless methods (key only) are supported (Feb 2021)
• Namecheap
  • Yubico guide
  • Namecheap guide
• Nextcloud
  • Requires app
• Nitrado
  • Nitrado guide
• Okta
  • Yubico guide
  • General Okta overview (nice summary table)
• OVH
  • OVH guide
• phpMyAdmin
  • phpMyAdmin guide
• Ping Identity
  • Yubico guide
  • Ping guide
• Porkbun
  • No public howtos, but they appear to be supported
• PyPi
  • PyPi blog post
• Rumble.run
  • YubiKeys and other WebAuthn-compatible keys are supported
  • Rumble guide
• Salesforce
  • Yubico guide
• Sentry
  • Sentry guide
• Shopify
  • Yubico guide
  • Shopify guide
• Stripe
  • Stripe guide
• Thycotic Secret Server
  • Yubico guide
  • Thycotic guide
• Tutanota
  • Tutanota blog post
• Twitter
  • Yubico guide
  • Twitter guide
  • NOTE: Twitter only supports a single key at this writing (2021-02-08). Multiple keys cannot be added.
• Vanguard
  • Yubico guide
  • Vanguard guide
  • Vanguard starting point (requires login)
• WordPress
  • Wordpress supports a plug-in to support YubiKeys on individual sites
  • Wordpress.com itself also supports YubiKeys
• Yahoo/AOL
  • Yahoo guide (also works for AOL)
  • AOL guide
• Zoho
  • Zoho guide

And here are some YubiKey OTP-based integrations (which predate U2F/WebAuthn):

• Pobox.com
  • Pobox MFA guide and YubiKey guide (YubiKey OTP only, not U2F/WebAuthn?)

Support claimed, but appears to be missing:

• eBay - last checked 2021-05-08
• Electronic Arts - last checked 2021-05-08
• fastly - last checked 2021-05-08. Only via Authenticator integration, so it's not YubiKey-specific.

Support also varies by platform:

• iOS
• Android

Other references

• Yubico Authenticator release notes - Android
• What the heck is a YubiKey and why did I buy one?": A user guide (sm-Fifteen)
• Understanding YubiKey PINs (Yubico)
• Why drive-by NFC attacks are not a concern for YubiKeys
• AAGUIDs for common keys
• PIV certificate slots
• Instructional Setup Series: YubiKey 5 Series (YouTube, Yubico)
• Yubico proposes WebAuthn protocol extension to simplify backup security keys
• Achieving FedRamp Compliance with the YubiKey FIPS Series Devices (Yubico)
• YubiKey Madness - simple howtos for many functions
• What's the risk from fake YubiKeys?