mirror of
https://github.com/privacyguides/privacyguides.org.git
synced 2025-09-12 21:18:50 +00:00
f9bd8204f2
Signed-off-by: fria <138676274+friadev@users.noreply.github.com> Signed-off-by: Daniel Gray <dngray@privacyguides.org>
142 lines
8.5 KiB
Markdown
142 lines
8.5 KiB
Markdown
---
|
|
title: "Security Keys"
|
|
icon: material/key-chain
|
|
description: These security keys provide a form of phishing-immune authentication for accounts that support it.
|
|
cover: multi-factor-authentication.webp
|
|
---
|
|
<small>Protects against the following threat(s):</small>
|
|
|
|
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals){ .pg-red }
|
|
- [:material-bug-outline: Passive Attacks](basics/common-threats.md#security-and-privacy){ .pg-orange }
|
|
|
|
A physical **security key** adds a very strong layer of protection to your online accounts. Compared to [authenticator apps](multi-factor-authentication.md), the FIDO2 security key protocol is immune to phishing, and cannot be compromised without physical possession of the key itself. Many services support FIDO2/WebAuthn as a multifactor authentication option for securing your account, and some services allow you to use a security key as a strong single-factor authenticator with passwordless authentication.
|
|
|
|
## Yubico Security Key
|
|
|
|
<div class="admonition recommendation" markdown>
|
|
|
|
<figure markdown="span">
|
|
{ width="315" }
|
|
</figure>
|
|
|
|
The **Yubico Security Key** series is the most cost-effective hardware security key with FIDO Level 2 certification[^1]. It supports FIDO2/WebAuthn and FIDO U2F, and works out of the box with most services that support a security key as a second factor, as well as many password managers.
|
|
|
|
[:octicons-home-16: Homepage](https://yubico.com/products/security-key){ .md-button .md-button--primary }
|
|
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
|
[:octicons-info-16:](https://docs.yubico.com){ .card-link title="Documentation" }
|
|
|
|
</details>
|
|
|
|
</div>
|
|
|
|
These keys are available in both USB-C and USB-A variants, and both options support NFC for use with a mobile device as well.
|
|
|
|
This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
|
|
|
- [Yubico Authenticator](https://yubico.com/products/yubico-authenticator)
|
|
- CCID Smart Card support (PIV-compatibile)
|
|
- OpenPGP
|
|
|
|
If you need any of those features, you should consider their higher-end [YubiKey](#yubikey) of products instead.
|
|
|
|
<div class="admonition warning" markdown>
|
|
<p class="admonition-title">Warning</p>
|
|
|
|
The firmware of Yubico's Security Keys is not updatable. If you want features in newer firmware versions, or if there is a vulnerability in the firmware version you are using, you would need to purchase a new key.
|
|
|
|
</div>
|
|
|
|
## YubiKey
|
|
|
|
<div class="admonition recommendation" markdown>
|
|
|
|
<figure markdown="span">
|
|
{ width="400" }
|
|
</figure>
|
|
|
|
The **YubiKey** series from Yubico are among the most popular security keys with FIDO Level 2 Certification[^1]. The YubiKey 5 Series has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), [Yubico OTP](basics/multi-factor-authentication.md#yubico-otp), [Personal Identity Verification (PIV)](https://developers.yubico.com/PIV), [OpenPGP](https://developers.yubico.com/PGP), and [TOTP and HOTP](https://developers.yubico.com/OATH) authentication.
|
|
|
|
[:octicons-home-16: Homepage](https://yubico.com/products/yubikey-5-overview){ .md-button .md-button--primary }
|
|
[:octicons-eye-16:](https://yubico.com/support/terms-conditions/privacy-notice){ .card-link title="Privacy Policy" }
|
|
[:octicons-info-16:](https://docs.yubico.com){ .card-link title="Documentation" }
|
|
|
|
</details>
|
|
|
|
</div>
|
|
|
|
The [comparison table](https://yubico.com/store/compare) shows how the YubiKeys compare to each other and to Yubico's [Security Key](#yubico-security-key) series in terms of features and other specifications. One of the benefits of the YubiKey series is that one key can do almost everything you could expect from a hardware security key. We encourage you to take their [quiz](https://yubico.com/quiz) before purchasing in order to make sure you choose the right security key.
|
|
|
|
YubiKeys can be programmed using the [YubiKey Manager](https://yubico.com/support/download/yubikey-manager) or [YubiKey Personalization Tools](https://yubico.com/support/download/yubikey-personalization-tools). For managing TOTP codes, you can use the [Yubico Authenticator](https://yubico.com/products/yubico-authenticator). All of Yubico's clients are open source.
|
|
|
|
For models which support HOTP and TOTP, there are 2 slots in the OTP interface which could be used for HOTP and 32 slots to store TOTP secrets. These secrets are stored encrypted on the key and never exposed to the devices they are plugged into. Once a seed (shared secret) is given to the Yubico Authenticator, it will only give out the six-digit codes, but never the seed. This security model helps limit what an attacker can do if they compromise one of the devices running the Yubico Authenticator and make the YubiKey resistant to a physical attacker.
|
|
|
|
<div class="admonition warning" markdown>
|
|
<p class="admonition-title">Warning</p>
|
|
|
|
The firmware of YubiKey is not updatable. If you want features in newer firmware versions, or if there is a vulnerability in the firmware version you are using, you would need to purchase a new key.
|
|
|
|
</div>
|
|
|
|
## Nitrokey
|
|
|
|
<div class="admonition recommendation" markdown>
|
|
|
|
<figure markdown="span">
|
|
{ width="300" }
|
|
</figure>
|
|
|
|
The **Nitrokey 3A Mini** [has FIDO Authenticator Level 1 Certification](https://www.nitrokey.com/news/2024/nitrokey-3a-mini-receives-official-fido2-certification). The Nitrokey 3 Series in general has a wide range of features such as [Universal 2nd Factor (U2F)](https://en.wikipedia.org/wiki/Universal_2nd_Factor), [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online), Personal Identity Verification (PIV), OpenPGP, and TOTP and HOTP authentication.
|
|
|
|
[:octicons-home-16: Homepage](https://nitrokey.com){ .md-button .md-button--primary }
|
|
[:octicons-eye-16:](https://nitrokey.com/data-privacy-policy){ .card-link title="Privacy Policy" }
|
|
[:octicons-info-16:](https://docs.nitrokey.com){ .card-link title="Documentation" }
|
|
|
|
</details>
|
|
|
|
</div>
|
|
|
|
The [comparison table](https://nitrokey.com/products/nitrokeys) shows how the different Nitrokey models compare to each other in terms of features and other specifications.
|
|
|
|
Nitrokey models can be configured using the [Nitrokey app](https://nitrokey.com/download).
|
|
|
|
The Nitrokey 3 Series can act as a password manager. They can store up to 50 different entries, and each entry can contain login, password, comment and OTP.
|
|
|
|
<div class="admonition warning" markdown>
|
|
<p class="admonition-title">Warning</p>
|
|
|
|
Excluding the Nitrokey 3, Nitrokeys with HOTP and TOTP storage do not have it encrypted, making them vulnerable to physical attacks.
|
|
|
|
</div>
|
|
|
|
**Nitrokey** also has the **Nitrokey Passkey**, a lower-price security key capable of [FIDO2 and WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online). This key provides only basic FIDO2 functionality, but for most people that is all you will need. Some notable features the Security Key series does **not** have include:
|
|
|
|
- Password Manager
|
|
- PIV
|
|
- OpenPGP
|
|
- Tamper-resistant smart card
|
|
- TOTP and HOTP
|
|
|
|
</div>
|
|
|
|
## Criteria
|
|
|
|
**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
|
|
|
|
### Minimum Requirements
|
|
|
|
- Must use high-quality, tamper-resistant hardware security modules.
|
|
- Must support the latest FIDO2 specification.
|
|
- Must not allow private key extraction.
|
|
- Devices which cost over $35 must support handling OpenPGP and S/MIME.
|
|
|
|
### Best-Case
|
|
|
|
Our best-case criteria represents what we would like to see from the perfect project in this category. Our recommendations may not include any or all of this functionality, but those which do may rank higher than others on this page.
|
|
|
|
- Should be available in USB-C form factor.
|
|
- Should be available with NFC.
|
|
- Should support TOTP secret storage.
|
|
- Should support secure firmware updates.
|
|
|
|
[^1]: Some governments or other organizations may require a key with Level 2 certification, but most people do not have to worry about this distinction.
|