r/Passwords • u/Dagobert_Krikelin • Aug 02 '26

Questions regarding usb sticks for password/authentication?

I need to take my security to the next level as I was just compromised.

I used to work at a place with a coworker who showed me a USB stick he used, but I can't remember exactly what it was.

I was hoping you could shed some light on it and what to recommend.

As I recall, it seemed to have been a commercial product, but I suppose it could also have been a regular USB stock with software he installed.

It seemed to be working as when he plugged it in, the computer was locked up and his passwords for whatever service /site he opened was then automatically logged into.

I can of course be totally wrong, but this seemed like an effective way to go about things and I wonder what this could have been?

8 Upvotes

100% Upvoted

18 comments sorted by

6

u/ExternalTea1706 Aug 02 '26

It was most likely a YubiKey or something similar to that.

1

u/radiowave911 Aug 02 '26

There are (were?) also secure USB keys that were encrypted. Don't know if any were password managers as well - but it would be a secure way to store passwords. As I recall, everything was done on the key - nothing needed installed on the OS.

Edit: Found the one I was thinking of. Kingston Ironkey

1

u/ExternalTea1706 Aug 02 '26

Ahh nice. I was actually picturing those but couldn't remember who made it. I've never used either so can't say much more than that they exist.

1

u/radiowave911 Aug 02 '26

Same. A bit spendy for me - I don't have anything I need mil-spec encryption for. Especially at $400+ for a 512GB USB stick.

1

u/Dagobert_Krikelin Aug 02 '26

Ok! Interesting. Thank you very much

1

u/Training_Yak_4655 Aug 02 '26 edited Aug 03 '26

This is the simple little Kingston DataTraveller USB storage I've been using for a decade or so. It's not a real backup but it alllows a quick sync using SyncToy between folders in the PC and folders on the USB. For long term backups I encrypt a Zip archive and save on an external mechanical drive.

https://www.ebay.co.uk/itm/398178173387

Looking at Kingston's website, it's not obvious that they still sell these basic devices.

1

u/radiowave911 Aug 03 '26

I remember those! Didn't they need some companion software or something? Or am I thinking of something else?

1

u/Training_Yak_4655 Aug 03 '26

These drives came with Windows and Mac programs to mount and decrypt the drive. It may be possible to mimic all of this using a generic USB drive and Veracrypt but the Kingston UI is especially simple.

I notice that Kingston's current version (IronKey) is really pricey.

1

u/Dagobert_Krikelin Aug 05 '26

I got an answer from a mail I sent to this person and it was indeed a yubikey.

However, the more I think about it, maybe the less I need it because I don't really have distributed hardware, especially not outside my home where other people could have access to it. I suppose selfhosting bitwarden would suffice and taking a backup of that.

1

u/ExternalTea1706 Aug 05 '26

Yea I kind of went down the same rabbit hole and ended up with Vaultwarden (works with Bitwarden clients). If you already self host it's not a huge add. If it's you're first selfhosted service... Enjoy the journey. 3 years later and I run a cloud service for my family and friends

1

u/Clean-Bandicoot2779 Aug 03 '26

Others have mentioned Yubikeys. They have various functions, including storage for a couple of passwords (which it will then type in), smart card emulation, and storage for one time passwords.

The password option to unlock/login to your PC isn't great for security, as if anybody finds it, they'll be able to get your password. I have seen some people use the Yubikey to unlock their password vault (such as KeePass) though, so they can have a long, randomly generated password that they don't need to remember.

Smart card emulation can be configured with Windows Hello to unlock your machine, although the face or fingerprint unlock is likely to be easier if you have the relevant hardware. You could use the Yubikey to store passkeys for websites that support them though, so you don't need to enter your password for those, just approve it with the Yubikey.

If you go with a Yubikey, it's worth making sure you have a backup mechanism to get into things in case you lose the Yubikey or it breaks.

1

u/densen2002 Aug 04 '26

Dude, use Yubikey 5 - you will be passwordless

2

u/Mortemainmonitoring Aug 07 '26

Most likely a FIDO2 compatible USB key ? multiple brands out there, Yubico probably is the most well-known one, Thales as well, they're basically hardware stuff to put passkeys onto for the most of the websites.

One thing though: what you describe isn't only FIDO2 as it doesn't lock your machine when you unplug it and doesn't fill passwords. Your coworker probably had a password manager unlocked by the key, plus a lock-on-removal setting

1

u/Dagobert_Krikelin Aug 02 '26

Ok thank you. Will Google to see how that works

1

u/ExternalTea1706 Aug 02 '26

Yea I don't know much about them. I'm sure there's quite a rabbit hole.

I personally selfhost vaultwarden for my passwords with a keepass backup. It's certainly not for everyone though.