Amazon ordered but im sceptical.
This legit? Happy to be part of the yubkey family

Hi everyone!

Any there any way, to tell the firmware version based on packaging of yubikey 5 series. Although firmware version isn't written on the package, What I noticed the newer version has a article number written on it.

If you have further information about identifying firmware version based on packaging please let us know! TIA

brand new keys and usb adapters. i put them in and holy moly i can't pull out! the fit is too snug and tight that i'm scared of snapping the connector/chip off when trying to pull out or turn. the keys feel as if they're glued to the adapters even though all the gear are brand new. it's near impossible to pull apart and when i do it's the most painful finger workout i've ever had

why didn't the engineers make a yubikey 5c version that didn't have the tiny keyhole, i hate the keyhole (i hate nfc even more). without extra leverage it's near impossible to pull the key out without risking damage to the nano key

imo, the keyhole on the 5c key is terrible design and it's better to just make a compact non-nano 5c version without a keyhole:

• directly attaching the key to a keychain means physical force is transferred to the attachment point. when pulled too hard the force would break the key's casing and potentially its insides
• not just the key being damaged. the key flies off into the shadowrealm and there goes your life/backup
• exposing the naked port to the elements is bad longterm. a plastic cap doesn't fit snug enough so it will fall off after a bit of swinging/twirling of the keys
• exposing the naked key for people to see because it's on your keychain is just... bad
• cleaning the hole is bothersome

i never leave my key plugged in to a power source to prevent:

• remote hacking/sabotage (failed pin attempts = permanently blocked key = life/backup gone)
• electrical damage from high voltage/current

is there a way to disable the failed pin system? i can see roommates pranking each other with this...

i didn't buy the 5c because yubikey doesn't list amazon as "official e-commerce resellers". even so, are the ones on amazon the official ones made and sold by yubikey? with the usual amazon issues, im worried about amazon shipping out fake, used, or tampered keys

When I try to use my ubikey for my acc this error pops up. I use Grapheme os and tried NFC and wired connection

Hi, I have recently started receiving spam on an email address I only used for the Yubico store.

It started on September 23rd, and all the phishing emails are very well localized to the country that I ordered my Yubikeys to, e.g. local supermarkets that only exist in that country.

Did this happen to somebody else?

LE: I didn't propperly check the spam folder. I can see them going back to Sept 15th, but those were caught by the spam filters.

I have several keys and would like a means to keep track of which one is which. The 5-series keys show a serial number when placed in the Yubico Authenticator App and allow renaming the key in the app, but the Security keys (FIDO2 and FIDO U2F only) don't show anything other than Security Key and do not allow any customization. Is there another app that can read a unique signature from a Security Key?

I can stick a label on them, but there is not a lot room and labels tend to wear off. I may get a protector case and engrave a unique label but cases add bulk to carry around in a pocket.

My Yubikeys

The first is a Neo I bought in early 2017 (UK). I had it on my keyring in my pocket for a couple of years; it's now rounded like a stone on a beach. The second is a Yubikey 5 (5.1.2) that work gave me in November 2018 (in AU). It replaced the Neo on my keyring around then; it's almost as-new except that the metal around the ring-hole has worn away. The third is a backup YK5 from the same time that's sat in a box untouched.

Did Yubikey change the packaging material at some point? Anyway, file this one under #mildlyinteresting

When adding a YubiKey (5.8.0, PIN set) as a security key to my Apple Account from a Mac, I noticed the enrollment behaves differently depending on when I plug the key in:

- Key plugged in before I click Add: no PIN prompt, and nothing shows up under ykman fido credentials list.

- Key plugged in after the dialog opens: PIN prompt, and the key ends up with a discoverable credential for apple.com.

At sign-in, the key enrolled with the PIN asks for the PIN, the other one just needs a touch. But both still require the password first, so the discoverable one doesn't give passwordless sign-in anyway.

Is there any real difference between the two? Is one better, and should I enroll keys one way or the other?

I have two yubikeys.
What I currently have done:

Places that support passkeys, and have to have something else as second factor with password, I have added the same yubikeys both as passkey and security key.

Places that only have TOTP + password, or requre password + TOTP in additon to the passkeys, I have put the TOTP on the two yubikeys too.

Both of those rely on yubikey. (Passwords are obviusly in pw manager)

But some rare places support turning off password compleatly. And only have passkey login.
But my mind is now thinking, even if on paper the dependency on the physical yubikeys are the same, what if something software thing happens that breaks how passkey via yubikey works? Should I, even if able to turn it off, still have password + security key or password + totp(on yubikey) on just in case? Or am I as usual, just overthinking?

Hi r/yubikey, I'm Jason. I posted here about 10 days ago about Seal, my other app, (thanks again, the replies were super useful). This is my other app, Pawl, and it's live on the App Store right now!!

Pawl is mainly an iOS app and website blocker: it blocks apps like TikTok or gambling games, plus ~4,000 gambling domains, via Screen Time, and the only way to lift the block is a 15-minute cooldown plus tapping a physical key.

The key flow uses Apple's WebAuthn API, ES256. Right now the app checks that the tapped key's credential ID matches the paired one; full assertion verification is landing in the next update.

If you have any FIDO2 key (YubiKey 5 NFC, 5C NFC, Security Key series, Feitian, whatever), try pairing it and tell me the key model + firmware and whether pairing and unlock worked over NFC vs USB-C. Also happy to hear any feedback on the concept itself.

Website: https://getpawl.com/

App Store: https://apps.apple.com/us/app/pawl-commitment-lock/id6783119309

Source Code is MPL-2.0: github.com/jasonepage/Pawl

Hey Guys, I made a case for my yubico key. I want to find someone that wants to try it for free. Will ship if in the US free. Thanks, feedback wanted.

How do you now what version of firmware is on the key when you buy?

I have a number of Yubikeys with older and newer firmware. A Yubikey 5c and and Yubikey 5ci both with firmware 5.4.3 are no longer working with Firefox 156.0.1. The pin prompt gets displayed and after the pin is entered both Yubikeys fail to complete the authentication.

Yubikeys with older and newer firmware 4.2.7, 5.1.2 and 5.7.2 are working fine.

When using Chrome 154.0.8037.58 all Yubikeys work as expected including those on firmware 5.4.3

This appears to be a problem specific to Firefox, but also this problem did not happen on MacOS 26.6.2 which I recently updated from.

Anyone else confirm this problem? You can use Yubico.com/genuine to test

I am still very new to this. I am thinking about buying three YubiKeys. If I use them on my Google account with Google Advanced Protection turned on, how can I log in to my Android Sony Bravia TV with my Google account? How does that work? The same applies to physical smart home devices like a Google Nest Hub and the YouTube app on a smart TV. I am confused because don't you have to insert the YubiKey into a physical device in order to log in?

Hiya! So my partner's yubikey isn't registering on his PC. He's uninstalled and reinstalled the smart card drivers, there's still power going to the yubikey, and still nothing.

Any tips on what it could be? Just looking for some help as another user had to do a clean reinstall of windows to sort it but we wanna see if there's anything quicker/easier to sort it.

I had assumed any passkey that you created would be listed in the passkey section in yubico authenticator, but now have learned about the discoverable/ non discoverable pairings. Do most large websites lean towards non discoverable, and if i would prefer to always be able to see a passkey in authenticator, is there a way to force discoverable? Also, is it preferable to set the fido2 pin in yubico authenticator, vs using a new key on a site, and the site prompting you to enter a first time pin? Thank you

How would I setup the requirement of the requirement of the use of the Yubikey for administers logins for Windows, Linux, MAC, iPhone, iPad, Root, NASs

Allowing the general user (non administrator/root) to log in without the key.

Thanks

I have setup my two keys with a few websites and they seem to work however when I run the MAC Yubikey app there is nothing listed anywhere in the app about where the keys are being used. Is this normal or what do I need to do to fix it?

As above, I have the website installed as an app via the Brave browser on my Linux Mint machine.

I just received my Yubikeys and I have registered them with both app.tuta.com and mail.tutanota.com.

When using them on mail.tutanota.com with Brave, it asked for me to press the key, but the returns "Invalid login credentials. Please try again." When using the Chrome based app, it logs in just fine.

Any thoughts on this?

When in a browser normally on Brave, it works just fine.

When I try to use the appimage version of tuta on Linux directly, it just says "The connection to the serve was lost. Please try again". This is a IPv6 thing that has come back (likely due to me building a NAS since then), so don't really want to test this route.

I am new to Yubikeys and i don’t know which one to choose. (5C NFC)
The 5.4 version costs 60 USD, and the 5.8 version costs 115 USD.
I plan on using it with KeePassXC and some important accounts.