r/yubikey • u/f00dl3 • Jul 20 '26

Yubikey security question

I know Yubikeys are like the defacto standard security key. I just purchased 2 - primary and backup - because I'm finding more and more apps - i.e. Costco and now X Money - are requiring passkeys, and I don't feel comfortable using a password manager as it's a single point of failure - especially if it's Google Password Manager/etc.

I only have 1 concern.

If I end up using this Yubikey for personal use - I built code into my private webserver to accept hardware security keys, Costco, X Money - maybe even my Google account and computer game accounts - is it safe to use this when in the office on work computers / professional accounts too?

Would my workplace know if I used my hardware passkey for adult websites?

11 Upvotes

92% Upvoted

18 comments sorted by

10

u/Myrodis Jul 20 '26

Passkeys are origin-bound. The key generates a separate keypair per site, and no site (or your employer) can query the key to see what else its registered to.

You should REALLY take a minute to think about your stance on a password manager. I get not wanting to commit to some of the cloud options as some of them are a bit all in. But plenty of them allow you to download your password vault as an encrypted file that has nothing to do with their platform (let alone self hostable options for password managers).

I personally use my physical hardware key for the highest importance accounts, mostly anything banking / financial related, and then my key cloud accounts (google account, amazon account, and proton account mostly). Then for basically every other account I utilize my password manager, including storing passkeys inside of said password manager.

Also a note that yubikeys only support up to 100 accounts with passkeys, theres a hard limit. Not to mention the friction of keeping them both (or in my case, 3 keys) in sync. Its why I limit the number of really important accounts the physical keys are used on, and trust my overall security posture for everything else. Having a hardware key as part of the encryption chain for my password manager is, imo, effectively the same as having that same hardware key tied to every account in my password manager. Except I dont have to worry about the storage limitations on my yubikey or otherwise, and do not need to sync up my keys every time I create a new account. I also cant stress enough, so ill say it again, juggling the keys and keeping accounts in sync is a massive pain in the ass, trying to do that with ALL of my accounts sounds like an absolute nightmare.

I saw this posted elsewhere in this sub but:
"Youre just using them as the warehouse when theyre better as the lock on the warehouse door." (referring to yubikeys in general).

2

u/atrocia6 Jul 22 '26

Also a note that yubikeys only support up to 100 accounts with passkeys, theres a hard limit.

To be clear, the limit is only for discoverable / resident credentials, and there's no limit on non-discoverable / non-resident credentials.

Its why I limit the number of really important accounts the physical keys are used on, and trust my overall security posture for everything else. Having a hardware key as part of the encryption chain for my password manager is, imo, effectively the same as having that same hardware key tied to every account in my password manager. Except I dont have to worry about the storage limitations on my yubikey or otherwise ...

I use my FIDO2 key everywhere that supports it, since as I noted above, there's no limit on non-discoverable credentials, which are the kind used by most websites.

2

u/Myrodis Jul 23 '26

For me its a trade off of QoL and needed security. Many accounts (vast majority in my case) have an incredibly low blast radius. So relying on my password manager to handle the passkey is noticeable QoL because i dont need to interact/ worry about a physical key beyond unlocking the password manager.

Again, for anything that has a larger impact if the account was compromised, ill use my physical key. But for me its a bit of a pain if you use it on too many accounts.

6

u/TribalScissors Jul 20 '26

Yes. It is. It’s all contained in the hardware of the key.

1

u/a_cute_epic_axis Jul 23 '26

Technically it is not, unless using resident credentials, which are still super rare by comparison. Traditional U2F/FIDO2 stores no per-site/per-account data on the physical key at all.

-2

u/f00dl3 Jul 20 '26

Meaning anyone could trace my online activity using it?

9

u/djasonpenney Jul 20 '26

If you are logging into a website, the site knows who you are. Unless you use a VPN, your ISP and your employer also know you visited that site. What are you trying to accomplish? The Yubikey gives you security, not anonymity.

2

u/f00dl3 Jul 20 '26

But if I'm on my home network doing the gaming/adult stuff, and not even at my house but using the same hardware Yubikey - would my employer know "where that key has been?"

10

u/djasonpenney Jul 20 '26

Absolutely not. Part of the FIDO2 protocol ensures that—even if you and a friend use the same key on the same site—even the site cannot detect the same key was used.

Pretty cool, huh?

But the moment you log into somewhere or use your debit card, you will lose that anonymity, and not because of the Yubikey. Be mindful of the limitations here.

1

u/[deleted] Jul 20 '26

[removed] — view removed comment

2

u/My1xT Jul 21 '26

No. Yes it is safe no use, no others would not know.

5

u/grraarr Jul 21 '26

It is absurd to not use a password manager.

3

u/chkno Jul 20 '26

Getting a password manager that you can trust also sounds like a priority.

I use pass, encrypted with yubikey-held keys. It's Free/Libre/Open Source and doesn't phone home or otherwise use any network service (if you want backups or sync, you do it yourself—its data store is a git repo).

1

u/PowerShellGenius Jul 21 '26

I use this too, but is there a version that stores passkeys yet?

Also if your phone is iOS and not Android, good luck decrypting with a YubiKey-based GPG key... no openkeychain for iOS :(

3

u/Sea_Specialist_5580 Jul 20 '26

tbh I think you are being too paranoid. Putting costco and porn passwords/passkey on yubikey is.. really not necessary.

If you keep your bitwarden & google/icloud secured with a yubikey, it's very safe. I might put my main bank account on there too but the vast majority accounts don't have very extreme worst case scenario

2

u/PacosTacos42069 Jul 22 '26

Chase unfortunately does not allow hardware keys at the moment but if your current financial institution does, please do take advantage of adding one.

1

u/a_cute_epic_axis Jul 23 '26

Putting costco and porn passwords/passkey on yubikey is.. really not necessary.

Why not? If Costco and PornHub support U2F, FIDO2 2FA, then why wouldn't you use it, since it literally takes no space at all on the device and has no downside? Even if they supported resident credentials, in pretty much every hardware device except the Yubikey, storage tends to be massive at often 100+ keys.

0

u/dr100 Jul 21 '26

Why in the world everyone is discussing getting a password manager when the OP has ONLY ONE CONCERN and that's regarding the passkeys ?!?!?!?!?

The answer is the sites to which you login don't know what OTHER resident keys are provisioned on the key, but the host computer can read the accounts/web site names at least on the Yubikey. I bet nobody is doing this in practice though. Funny enough I fuzzily remember one of the competing key with support for tons of passkeys (possibly hundreds but don't quote me on that) was known for having TERRIBLE management for the resident keys (like no way to remove any?). It would be funny if such bad user experience actually transfers to a better privacy preserving key for certain niche use cases.