I Visit Yubico's HQ to investigate the security of 2FA keys

[@AllThingsSecured]

What do you think? Does seeing "behind closed doors" give you more confidence using a YubiKey? And if you don't have your own security keys, get $5 off using this link: yubi.co/all-things-secured-2024

[@a1isrising]

do i still need a password managet and and some othet form of 2FA too , or can i just use Yubi key for log in for email , and other sites where its accepted , im not tech savvy and get confused as to what i need for privacy and secrurity thats easy to use and impliment as i still use free gmail and i eant to switch to a paid for email for secrirty and privacy im not so much worried about goverment im more concerned about hacks , mitm and others i dont even know of lol , thanks for any info great channel i learn a lot frim you

[@currentfaves65]

I would be interested in using this for banking. Bank America seems to be the only banking using 2FA keys.

[@AllThingsSecured]

Yea, unfortunately banks have been slow to adopt the FIDO standard for security. It's coming, I hear!

[@uzlonewolf]

No, it does the opposite. Absolutely nothing of substance was shown, and this whole thing feels like a corporate PR piece from a corporation desperate to try and convince you their closed-source security-through-obscurity binary blob is actually good for you.

[@-Oleg1]

Good joke. 404 error We can't find that page. Sorry!

[@asinheaven]

Now if only our financial institutions would let us use them...

[@SteveHowardPhotography]

or Amazon Shopping too

[@sandcat731]

Works on amazon ​@@SteveHowardPhotography

[@Darkk6969]

Bank of America supports them.

[@Back2SquareOne]

You are so right. The fact that almost no big banks or investment companies support any 2FA beyond SMS, which is known to be vulnerable to sim card cloning attacks, is absolutely shameful. I would love to see more KZbinrs like @AllThingsSecured publicly calling out these institutions. They are failing their customers. Too often when customers are victimized they just wash their hands of it even thought they refused to provide modern methods to secure accounts like security keys. In the meantime, people need to do everything they can to protect themselves by securing all their recovery methods like their email and their phone's sim card. The banking institutions will only change when this becomes a big enough issue to be perceived as a competitive disadvantage.

[@MikeJones__Who]

It's honestly going to take government regulation to force them at this point. If they haven't done it already out of their own will...they'll never do it unless compelled.

[@reefhound9902]

The biggest thing holding me back is their limited acceptance, especially with what I consider my most import accounts - financial and government. I don't want to have to keep track of a hodge podge variety of ways to authenticate.

[@CedroCron]

Thanks for going there and finding out. I appreciate it as a YubiKey user!

[@AllThingsSecured]

Thanks for watching and commenting!

[@plproductions8887]

Love the videos you’ve help so much with security and learned a lot keep it up.

[@AllThingsSecured]

Glad you like them!

[@WBTat2]

I knew nothing about security keys and just picked one happened to be yubico and I’ve heard nothing but good and I’m glad I trusted my gut

[@hhbadarin]

Bought one of their keys 3 years ago, couldn't be happier!

[@Melker63]

Hardware-based authorization-keys are very hard to beat. But it does require a functional and accessible USB-C port - leaving the physical phone potentially vulnerable to advanced tampering attacks. Physical USB-blockers from Smartkeeper is a possible option. Anyway, there is an argument for app-based authenticators and charging through wireless induction only - you can completely seal off the USB-C access alltogether. But that perhaps a too tough compromise to pay.

[@AllThingsSecured]

I’m not sure I follow. These keys also allow for NFC, which is just a tap on the phone, not plugged in, so you’re not dealing with the phone port at all.

[@Melker63]

​@@AllThingsSecuredOK, I don't actually own and use one of these keys myself. So I misunderstood whats possible. I think I have some catch-up reading to do. 😊

[@BillAnt]

​@@AllThingsSecured - All these security keys can be emulated in an app like "Google Authenticatior", which essentially it does the same thing, of course it's only as secure your phone. Security keys are just a purpose build device which does one thing, and one thing only. One has to chose between the convenience of an all always on phone vs. carrying a key and plug-in/tap.

[@BillAnt]

@@AllThingsSecured - All these security keys can be emulated in an app like "Google Authenticatior", which essentially it does the same thing, of course it's only as secure your phone.

[@BillAnt]

@@AllThingsSecured - Security keys are just a purpose build device which does one thing, and one thing only. One has to chose between the convenience of an all always on phone vs. carrying a key and plug-in/tap.

[@steveshuffle]

great video Josh! And you were sooo lucky with the weather for April :D

[@AllThingsSecured]

Ha! It was actually filmed in a different month, but the weather was fantastic.

[@MysticMylesZ]

Can't wait to get me hands on one of these products. I hope to make them as important as a phone to me and my family.

[@malindailankoon]

A video i really wanted to watch, thanks so much

[@AllThingsSecured]

My pleasure! Glad you enjoyed it.

[@azclaimjumper]

One of your earlier Yubico videos convinced me to buy 2 Yubico keys. Both keys have done exactly what they're supposed to on both of my macs are "Smart Card Required" & all my accounts that allow/permit 2FA with hardware keys. Sadly, banks & brokerage firms don't allow Hardware Keys to be used for 2FA. Only Bank of America & Vanguard allow Yubikeys for 2FA for their customers.

[@AllThingsSecured]

Yea, I don’t know why banks have been so slow to adopt a better security standard.

[@Darkk6969]

@@AllThingsSecured Easy. IT Support. Banks don't want to spend alot of money in IT Support for their customers with 2FA issues.

[@stephenfromfing4430]

Been to Stockholm, it's a wonderful city. That ship is epic! Would love to see it during the summer (we went during the winter).

[@pierres_blog]

My God. They make some of the devices in the US? Well there goes any hope of trust. I was hoping they were all made in Sweden!

[@SpiritintheSky.]

Interesting and enjoyable video, particularly as I've owned a pair of yubikeys (one in reserve) for two years. But I've always had great difficulty negotiating (not "navigating"!) Yubico's extraordinarily complex website. The firm's helpline has been of little help, especially concerning the so-far impossibility of obtaining my keys' PINS. These are required for use with some websites - some very important - such as Microsoft's. Any chance, please, of you covering Yubico's PINs in another of your passkey videos?

[@CharlieDawsonMusic]

Well Done! I Always love your videos and this was so interesting. Thanks for all your efforts.

[@AllThingsSecured]

My pleasure, Charlie! Thanks for watching and commenting. 👍🏻

[@barrykandell623]

I was hoping all of my high risk apps used the yubikey such as banking etc

[@PXX-t1j]

Good call. Interesting to see about this. Since I'm Swedish but living abroad I bought Yubikey.

[@Mkbshg8]

Cool. What happens if you lose the physical key though?

[@AllThingsSecured]

That’s why I have a backup. Either a second key that I store in a secure place or a backup code/phrase that I store offline.

[@cjc363636]

My Q as well!

[@CiroMorra]

@@AllThingsSecured The downside of a second key is that some services make the last hardware key entered the primary without an option to change this to a "backup key". This is not Yubico/Yubikey related but really annoying. Some software/services are really not up to speed with using amd adopting hardware keys. Using hardware keys on a Android phone / Chromebook can be a real pain sometimes e.g. when they do not use the NFC chip but expect a physical key to be inserted. Disclaimer: I also use Yubikeys but the CEO not being able to enter their workshop does not give me less or more trust in their products. There so many options to manipulate a service/product somewhere else in the supply chain.

[@swrenn]

Question about setting up my keys. The Bitwarden extension tries to save it. When I choose hardware key, should I choose just this once or all the time? And how do i change it to once if I chose all the time?

[@SyberPrepper]

Thank you for the video.

[@AllThingsSecured]

You’re welcome!

[@Provocateur3]

Plz consider doing a review on the Quetta browser sometime.

[@SteveHowardPhotography]

I love my Yubikeys but I can use your advice. How do you carry yours around so you always have one on hand? Neck lanyards are uncomfortable, and I don't always have car keys with me. I'm open to any suggestions. Thanks for ALL your videos and advice.

[@justicefool3942]

For me personally, I didn't always have my car keys with me until I got my Yubikey and added it to my keychain. After that, I always have it with me just in case.

[@SteveHowardPhotography]

@@justicefool3942 Thanks for your input. Guess I just need to decide - lanyard or keys. Thanks for your reply

[@SteveHowardPhotography]

@@localfixx4184 Great idea. Thanks for the tip!

[@Anondady]

Nice video just wanted to mention that the music in the video is far louder than your voice level. Thanks.

[@AllThingsSecured]

Thanks for the feedback. I’ll try to do better next time 👍🏻

[@JohnSebeny]

Any recommendations for a USB adapter to go from C to A?

[@AllThingsSecured]

You can get a cheap one off of Amazon. Or just buy the correct YubiKey.

[@mikaellundqvist]

Hello. I hope your visit to Stockholm was nice. I trust the Swedish security keys because I know it’s basically the same cryptography as the new passkeys and offers the strongest possible security. What’s best about these YubiKeys is that they are separated from the Mac, iPhone or whatever you might be using to offer even stronger security for your accounts. Cheers! 👋

[@AllThingsSecured]

Thanks, Mikael! It was a wonderful trip.

[@northerngit1620northengit]

Hi Josh, how would i know which accounts i have on which Yubikey? As I intend to buy 6. Cheers

[@dennism2111]

There are so many things I still don't understand about computer security. Do the Yubikey secure anything other than email? Since Microsoft requires their corporate users to use Yubikey how did Russian hackers breach Microsoft recently? It must have had nothing to do with corporate user logins.

[@Darkk6969]

They stole the session tokens. No two factor will prevent that. It's up to the controls of those tokens.

[@currentfaves65]

Went to Yibico's list of companies that their key works with. NOT IN ALPHABETICAL ORDER, not even by category. They should at least break this down by category such as banking, linux, microsoft, apple, android etc. For me, secure banking, email and securing my device are the only uses of interest to me. And none of my American banks is listed. In fact, I think Bank of America is the only bank. Ultimately, not sure I want to risk this. Lose the key or the key gets corrupted and I am locked out of my bank to do what ? It does, however, sound like a great solution for a large company.

[@hiddenlawyer]

General advice for not just physical 2fa keys, but other critical things as well. Backups. I have 3 yubi keys, one that stays at home, one that stays at work, and one in my wallet. Once I onboard a key to an account, I also onboard the others as soon as I can. I also do not trust leaving a regular yubi key laying around, so all of my keys are the bio series which requires a fingerprint scan. Accounts that do not support more than one physical key in my mind are flawed implementations implemented by incompetent staff.

[@AllThingsSecured]

This isn't a Yubico problem, it's an industry problem. Banks have notoriously been slow to adopt higher 2FA standards and it's not that they don't accept YubiKeys, it's that they don't accept ANY 2FA keys at all. It's unfortunately and hopefully something that will change eventually. Locking down your email (Gmail, Outlook, Yahoo), your mobile device (Apple iOS, Android), your retirement accounts (Vanguard) and other such important accounts make this much more than just a good solution for a "large company". You don't have to use a YubiKey, but if you're not using 2FA of some kind, you're making a big mistake.

[@currentfaves65]

@@AllThingsSecured I appreciate your videos and for taking the time to reply ! I too really wish the banking industry would take security more seriously.

[@uzlonewolf]

@@AllThingsSecured Most banks do actually support hardware tokens, it's just that you must purchase their token directly from them. Wells Fargo for example will sell you a RSA SecurID token for $25.

[@namesame]

05:04 Which enterprise has million-unit requirement? Can't be big tech companies that max out around 100k employees each. Looks like a way to avoid saying "Government", which would question the credibility of the review as the Government is funding it's agencies to break crypto systems.

[@HaMou261]

What if you lose the Key or get damaged?

[@just__mike]

You always need a backup key.

[@AllThingsSecured]

Exactly. The best thing is to have a backup key. If not that, then you need to keep another kind of backup offline.

[@Crazy_Hoon285]

Hey im really scared i was trying to mod a game and downloaded a mod that everyone said was safe but the site that i got it off you had to sign up ive tried deleting the account but apparently you cant on this website

[@AllThingsSecured]

Sorry to hear that. Not sure how it has anything to do with 2FA keys, though.

[@Crazy_Hoon285]

@@AllThingsSecured I just wanted to reach out to you for some advice I'm only ney to computers

[@BigGroupHug]

If you're gonna be silly on the internet, create unique email accounts for every sketchy website. Are you 12?

[@dasmouse2557]

The way I read your message, US market is served by keys manufactured in the USA. Just being paranoid for a second... why? Who else has the keys? Eventually, this is another crypto solution. Remembering Crypto AG from Zug, Switzerland. Who else has the keys?

[@AllThingsSecured]

I'm not sure I follow the question. How is a 2FA key related to crypto?

[@Akillian1]

testing

[@DumpsterJuice4U]

2:31 That flag is spilling over into Canada lol xD

[@AllThingsSecured]

Ha! Sorry about that.

[@PlacestobeVG]

lol idk why this made me laugh

[@ExploitedShells]

This dude is the whole PR team of Yubico, never seen a single KZbin creator pump so much content for a single product.

[@AllThingsSecured]

I know, right?? Isn’t it just nuts how a security and privacy KZbinr talks SO MUCH about actual security and privacy tools like password managers, encrypted email and 2FA keys all the time?! It’s just unbelievable. I mean, you’d almost think that it’d be better for somebody who wasn’t interested in actual security and privacy to just, you know…unsubscribe 🤷‍♂️

[@CiroMorra]

You can use any other brand of compatible key if you want, all content about why and how to use it still apply. It's all about the chip and formfactor, not the brand.

[@rjain1993]

👍🏻

[@AllThingsSecured]

🙌

[@VirtualCreativity]

Old Days Was Secure. When You Had To Wait For Someones Letter.

[@AllThingsSecured]

How does that relate to 2FA security keys?

[@VirtualCreativity]

@@AllThingsSecured no technology no more tension about privacy security.

[@simev500]

So a digital key within a physical fob is the improved newfangled security now. And this you add to that metal ring that holds the rest of your brass house keys in a pocket/purse in your person. Anyone see the irony here? 😜😂🤭 P.S. No putdown on new technology. It just seems an old artifact, a metal key, to open a physical lock was replaced by a digital key, the new artifact, which is now encased inside a hard plastic fob that is no different than the old artifact, the aforementioned metal key. Plus the bulk.

[@AllThingsSecured]

I wouldn't call it "newfangled" since the technology has been around for decades.

[@Zermatt2024]

Can’t use on smart phone = deal killer.

[@iRyan230]

But…you can use them with smartphones via NFC or USB-C/Lightning port.

[@Waltaere]

All Thiings 😃, ands omg 🫢 an interview with one of my favorite companies 😱

[@AllThingsSecured]

👍🏻👍🏻🙏🙏