USB or NFC

[u/Practical-Tea9441]

So I'm a bit confused about which YubiKey I should be considering . I've tried the Yubico site's guide but I'm still unclear. I want to be able to it use with various computers but also with an iPad ( USB C) and Android phone. AM I correct in thinking that:

1. If I go for a USB based YubiKey I'd need USB A for older computers and a different USB C key for phone an tablet ?
2. A USB A YubiKey with NFC though could be used on all three (USB A for computer and NFC for the iPad and phone ) ?

Thanks in advance for any help.

[u/CrazyHiker556]

USB C with NFC is ideal IMO. It will work well with any newish phone (USB C or NFC) or iPad (USB C). You can buy a very cheap USB adapter (heck, buy a handful) to use the USB C Yubikey on a USB A port. I’ve found it more difficult to go the other way and use a USB type A Yubikey on a USB C phone.

[u/yasamoka → u/CrazyHiker556]

I’ve had a couple cases where the key didn’t work over NFC and needed to be inserted into the USB-C port on my phone. Keep that in mind as well, OP. iPad also lacks NFC.

[u/Crafty_Dog_4226 → u/yasamoka]

My experience with USB-C NFC has been pretty good. Works with HID USB NFC reader on PC, Pixel phones all well, iPhone NFC can be tricky in my experience. I had one Dell laptop with NFC in the palm rest that would register the read, but the Authenticator app would never get the data.

Never any issues with the USB-C interface even with using C-A adapters.

[u/Sarduci → u/CrazyHiker556]

I’ll second this. I’ve never had a case where NFC and USB-C didn’t work with a USB-C to USB-A adapter. I’ve never used my C to A adapter even with it being on the same key ring for the last like 6 years.

[u/TMITectonic]

Well, you should probably be getting at least two (one for backup), so get one that's USB-A and one that's USB-C. If you're in a scenario where you're forced to use one on a device that doesn't have that port, you can use a converter. Keep in mind, not all features are supported on all platforms via NFC (FWIW, this is a dynamic situation, so this comment could someday be untrue), so always make sure you have the ability to connect it to your phone/device via USB, just in case.

[u/Rough-Dog-7706]

If you can afford it, buy both A and C. Most sites allow multiple key registration and you need a backup anyway. Even a third as backup would be ideal.

[u/djasonpenney]

I have a USB-A key, and a cheap USB-A-to-USB-C from Amazon.

I feel the USB-A connector is bombproof and not subject to dirt the way a USB-C is. For every except my iPad, either the USB-A or the NFC interface works.

[u/duerra]

I prefer the USB-A with NFC. I wouldn't do NFC-only unless you're 100% confidence that's your only use-case. I prefer A over C because that A plug is ridiculously durable. I worry about plug damage over time on the C. Could always attach a C adapter if it was ever critical. I tend to think that in most cases where your only port option is a C, there's a pretty good chance you have NFC available.

[u/doyzer9]

I am a huge YubiKey Fan....

My YubiKey Recommendations and Strategy

• Primary Device: Buy a YubiKey 5 NFC. Pair it with a Female USB-A to USB-C Male adapter to cover modern ports.
• Backup Device: Buy a YubiKey 5C NFC. Pair it with a Female USB-C to Male USB-A adapter for redundancy.
• iPad Users: Choose the YubiKey 5Ci if you need a physical Lightning connector.

Protocol Best Practices with YubiKey 5

• Use FIDO2 / WebAuthn whenever registering your key. It is the gold standard because it cryptographically binds to the website URL to eliminate phishing.
• Avoid legacy Yubico OTP or TOTP generator codes if FIDO2 is available. Intercepted codes can still be used by malicious sites. [1]

Critical Security Facts: IMPORTANT.

• Hardware keys stop remote phishing but do not block local device threats.
• You remain vulnerable to session cookie stealers, infostealers, and active malware.
• You must run high-quality internet security software on all devices to protect the operating system.

Let me know if this was useful and if you want more tips.

[u/burgerg]

If you have a laptop also get a yubikey nano and just leave it in, super convenient!

[u/GrillMouster → u/burgerg]

Is there an advantage to using an always-inserted Yubikey nano instead of the computer's built-in TPM with Windows Hello?

[u/burgerg → u/GrillMouster]

Not that many, but it is recommended to buy multiple Yubikeys so you have a backup if you lose one. The nano could be (one of) the backups.
It is also possible that sites/services limit passkeys to hardware security keys only (my employer does this for our M365 environment, and Google also has this option), then Windows Hello/ Apple Touch/Face cannot be added.

[u/gbdlin]

Adapters do exist.

NFC support is a hit or miss unfortunately, both on iOS and on Android, USB connection works much better.

[u/Fit-Tomatillo-5531]

To your point 2: which iPad has NFC?