Yubico YubiKey Reviews

Yubico YubiKey is my main hardware security key designed to provide multifactor authentication and for logging into my account. I typically use Yubico YubiKey to log into my corporate infrastructure at the start of my day. Instead of typing the key, I use the push notification on my phone when I insert Yubico YubiKey. It uses FIDO Web Authentication and makes authentication resistant to phishing.

The best features Yubico YubiKey offers are the major reasons we use it as a hardware MFA to create a token because it is phishing resistant. It guarantees the authentication works on a valid cryptographically verified domain, and it supports multiple protocols and authenticator capability. It is based on challenge-response mode, and it has extremely physical durability. It has a dual interface where you can plug it into a laptop or against an iOS and Android mobile phone. The private keys are generated directly on the internal secure chip and can never be exported by the host system or malware.

Reducing password reset and MFA lockout support tickets by 75% has reclaimed the engineering capacity, which can be redirected towards more core infrastructure priorities, such as automating the security pipelines, improving asset management, and building internal CLI AI tooling. It has eliminated employee downtime and has simpler compliance and lower operational friction.

Yubico YubiKey is an industry gold standard for phishing-resistant hardware, though immutable firmware and password key storage limits keep it just shy of a perfect score. The immutable firmware and password key storage limits have their limit and cannot be increased. Yubico YubiKey has no support for post-quantum security.

I have been using Yubico YubiKey for more than two years.

Yubico YubiKey is stable.

Yubico YubiKey is one per user and I do not believe it is very scalable.

We never use the customer support for Yubico YubiKey.

Regarding Yubico YubiKey's AI capabilities, it does not embed AI or machine learning capabilities in itself. Rather than introducing AI vulnerabilities, Yubico YubiKey serves as deterministic, non-AI security boundaries specifically deployed to govern and control access to AI infrastructure and protect against AI-driven identity attacks.

The advice I would give to others looking into using Yubico YubiKey is to always enroll two YubiKeys simultaneously so losing one does not lock you out. Match the model to the use case, get the budget of the security key series and standard web passkeys, and then store the service backup code offline in a safe place along with your backup keys. Disable the weaker MFA once registered and remove the SMS, email, and OTP fallback so that the attacker cannot bypass your hardware keys. I rate Yubico YubiKey 9.5 out of 10.

Negative

Basically, it works hand in hand with PingID, so PingID will prompt the user for the same use cases, including VPN, bulk application, and desktop or laptop. It'll prompt them to give the user a choice of whether they can do a swipe up on their phone, or they can plug in their YubiKey, and there's a little circle on the top. They touch it, and that releases the cryptographic key on the key itself and sends it back to the PingID back in service, indicating this is the key that you registered with previously. So that's how Yubico works. It lights up, and they touch it, and it releases the key cryptographic key that's on it.

In many cases, there's hesitancy to use the phone as the other alternative. Number one is that some people don't like to mix personal and business on their phones. They just want the phone for personal use. And number two, at some sites, it is banned on the shop floor. They don't want phones on the shop floor, or we have highly classified spaces here, in which the data is extremely confidential, and there's no possibility. It's physically secured to the point where the employees that manage that data cannot carry their phones into that space. So that being the case, the phone is not an option. So, we give YubiKey to them as an option.

It's small and lightweight. Like a phone, it doesn't run out of battery. It also doesn't have to be unlocked. It doesn't break. Moreover, they're very durable and it's very convenient. You just simply plug it in and touch it, plug it into the USB port, touch it, and you're authenticated at your end.

An area in the product that needs to be considered for improvement, as far as the product is concerned, is service needs. Currently, an area where the product lacks is in addressing service needs.

I wouldn't like to see new features since they're keeping up with all the compliance regulations.

I have experience with Yubico YubiKey for three years. I am using Yubico YubiKey Version 4.

Stability-wise, I rate the solution a ten out of ten.

It is a very scalable solution. Scalability-wise, I rate the solution a ten out of ten.

Once again, we're looking at biometrics, and I would say Yubico YubiKey will not go away. We'll continue to leverage those because the users like them. So I don't know if we'll expand it. I think it'll be kept at the same level of use. If not, maybe a little bit of a decline is removed towards biometrics.

Recently, I contacted Yubico's technical support, and it was pretty good.

There's really no such thing as a cloud or on-prem in the context of YubiKey because it's just something you hold, and it has firmware on it. And all it does is release the key to whatever's calling it from the cloud or on-prem. So it really doesn't have a server. It doesn't talk to a server. It just sits and waits for a PingID or a LastPass or some other authentication mechanism to call it.

There was a great return on investment for us since people like Yubico YubiKey so much.

I know the per-unit price, but I don't compare that to other dongles or physical devices.

Yubico has been a good partner with us, given we're a pretty large business. Just note that Yubico YubiKey can be obtained anywhere, even on, I think, Amazon.com. So, they're pretty much everywhere, and they are very widely used in businesses. They're used quite a bit. So, you know, don't just rely on Yubico YubiKey since there are other distributors out there. I think we were just using Yubico YubiKey because we were large, so we had a huge need for them.

It's been in and out of shop floors and has been tested for damages to see if it's broken, and I should say that it hasn't broken. So, it's very durable.

I rate the overall solution an eight out of ten.

The solution is simple to use and we have installed it in our clients' endpoints. The tool is just plug-and-play for the end user. The end user can just put in the key to the security computer and log in without any hassle. The solution is efficient, user-friendly, and easy to use. 

It would be better if the product can come up with a serial number for the keys. It would be nice if they had a numbering system as a configuration identity that would help the IT and technical teams to identify the keys because they look all the same. It would be more like putting a tag on them. 

The tool is stable. 

My company has 10-20 keys per client. 

The product is easy to configure and setup. 

We paid 100 bucks for one Yubikey. 

I would rate the product a ten out of ten.

We use the product for our clients. Every computer that is logged in has a token called Yubikey. There are Google tokens as well. Different companies have different sets of tokens. We used Yubikey because we felt that it was the right fit. 

As an IT person, I prefer the mobile since it's always at your fingertips and tokens can get lost whereby you won't be able to log in to your computer. I prefer Duo because its fast, easy, and good. 

We use YubiKey to authenticate online services with email, web, and Twitter. We deploy it for some sensitive administrative accounts to improve security. 

YubiKey is a hardware security device with advanced security features.

I have used YubiKey for three years.

YubiKey is highly stable. 

Deploying YubiKey is straightforward.

I rate YubiKey nine out of 10. I recommend YubiKey for admin accounts because it's much safer than mobile authentication. I wouldn't blindly deploy it for every account. It's a hardware device, so it isn't cost-effective to use for all your accounts. You might have a hard time getting budget approval. It's better to take a strategic approach and use it only for critical accounts. You can use other forms of authentication for the rest. 

There are some secure projects that my team and I work on that have files that everybody needs to use and we put them into a Yubico YubiKey secured file directory. We secure each file from there.

The most valuable feature of Yubico YubiKey is security.

Yubico YubiKey is inconvient. No one likes the idea of having to put a USB device into the system, having to remember to take it out, and having passwords. It may be very good for security but it is not great for people to use.

I have been using Yubico YubiKey for a while.

We have not had any problems with the stability of Yubico YubiKeys.

We have 14 total users using the solution and on secure projects, we have seven or eight users.

The initial setup of Yubico YubiKey it's not particularly complex. Where it is complex is when you have many Yubico YubiKeys. I currently have three different Yubico YubiKey and I wish I could consolidate all of them into one. I haven't taken the time to do that yet.

There is not a lot of maintenance needed for the solution. There are two of us in charge of granting access to user group files.

I rate Yubico YubiKey an eight out of ten.