You Should Be Using Yubikeys!

i bought my first set of ubi keys back in 2018. these are the yubikey 5 nfc model that i actually still use today i originally bought them to test them out for a video but in all honesty i really didn't know exactly how they worked how they were different from the google authenticator app that i was already using and whether or not it would be a good idea to switch over to a hardware key versus the software authenticator app because of that learning curve the original yubikey 5 nfcs that i purchased sat on my desk collecting dust for over a year then i was contacted by an engineer yubiko who was a fan of the channel and he heard me mention on a live stream that i had these keys sitting around unused and he wanted to educate me on how they worked after i met with him and learned a lot about how these hardware keys work i finally made the switch from google authenticator over to yubikey's and i haven't looked back i absolutely love this solution one of the main reasons that i love the ubi keys is actually pretty surprising as it has nothing to do with security it's that they're faster to use than authenticator apps on your smartphone but before we get into all of that let's cover the basics just what the heck is a ubi key and why should you be using one in this video we're going to talk about what ub keys are and we're going to show examples of how to set up and use uv keys for multiple different types of two-factor authentication and we're going to discuss why ubi keys are superior to authenticator apps in many ways if you're interested in jumping around to various points in the video check out the description for full time codes to the various topics and if you're interested in this type of content make sure you subscribe to crosstalk solutions and also follow us on twitter at crosstalk sol and if this video makes you realize that you'd be crazy to not start using yubi keys i'd appreciate it if you click the yubikey link below this is an affiliate link which gets me a few bucks for the referral but doesn't change your price at all and while i love that yubiko offered to sign me up for their affiliate program i actually purchased and started using yubi keys well before that happened so my opinions were not altered by the millions upon millions of dollars that i'm gonna get in affiliate revenue i'm just kidding of course it's really it's really not a lot but i do appreciate all the affiliate sales that i receive all right so let's get started what exactly are ubi keys well uv keys are basically hardware security keys created by a company called yubico these security keys plug into your computer or smartphone in various ways this one is a usb type a for instance i've got another one here this is the yubikey 5 ci that has lightning on one side and usb type c on the other side this yubikey 5 nfc is also wireless so you can do the nfc which i think is near field communication if i remember correctly anyways you can nfc this to your smartphone ub keys help facilitate two-factor authentication or 2fa for short two-factor authentication is a method to confirm someone's identity beyond just knowing the username and password to get into a website or service or other account 2fa can be achieved in a number of ways but typically we're talking about something that you have and something that you know so for instance when you go to the bank to pull money out of the atm you're using two-factor authentication you have something you know right your pin code or your password and you have something that you have which is your bank card you wouldn't ever want to only have a password on your bank account because anyone who knows your pin code or your password could just walk up to the atm and take money out of your account so it doesn't make much sense right same goes for all of your online accounts wherever possible you should be securing your accounts with 2fa the username and password is always one piece of the puzzle and should definitely follow best practices like don't use the same password on multiple accounts make sure your passwords are not easy to guess follow strong password guidelines etc etc password managers such as lastpass or one password make the process of handling strong unique passwords much easier so passwords are one piece of 2fa authentication that's the something that you know but as for the other piece the something that you have this can be achieved in many different ways most often it's going to be in the form of a one-time passcode and one way to do that is with sms but sms two-factor authentication is not very secure and it's been proven to be susceptible to compromise plus sms two-factor authentication requires network connectivity or you know sms connectivity in order to function properly a better method is to use an authenticator app on your smartphone or desktop which can produce otp codes or also known as totp codes time-based one-time password is what totp stands for the downside to authenticator apps is that while these apps are typically free they do require a mobile device which you know isn't the biggest deal since most everyone has a smartphone these days but for businesses there are logistical and administrative issues that surround supporting authenticator apps across whatever smartphone devices your employees may have not to mention the gray area of requiring your employees to install business applications on their personal cell phones so imagine standardizing your company on google authenticator for instance and then having to support all of your employees every time they buy a new device and they need to migrate their 2fa codes to that new phone the cost in terms of it administration can get pretty high if you choose to go that route and yes there are some authenticators such as twilio's offi that feature multi-device support but even with multi-device support as an i.t administrator you still have to support those multi-devices and many security experts argue that having tokens on multiple devices is risky i mean it kind of defeats the purpose of the something you have if you have multiple copies of your otp tokens imagine if you had 10 atm cards to access your bank account the chances are greater that you're going to lose one of those atm cards if you've got a whole bunch of them and on top of all of that what happens if the phone's battery dies in the middle of the day so by standardizing on hardware security keys instead your it administrative costs go way down all right ub keys are easy to use for your employees while providing much better security options than authenticator apps they don't rely on network connectivity to work and they don't have a battery that can die so as a direct replacement for authenticator apps the ubqs are great they have an authenticator app for windows mac os linux android and ios and as an added bonus the workflow for using yubico authenticator is actually faster than using something like google authenticator let's step through both methods and hopefully you guys will see what i'm talking about we'll start with google authenticator first a website's going to prompt you to enter in your 2fa code you now have to get out your smartphone unlock it find the google authenticator app open the app find the matching 2fa account you need and then enter the code manually hoping that you don't typo it if you're authenticating from your smartphone to a website on your desktop pc there's no copy paste there right you have to enter the code before it expires or else you're going to have to enter it again now let's step through the process for ubi keys i personally keep the ub key sticking out of the usb port on my keyboard which means it's always in the general vicinity of my hands so first i'm prompted for the 2fa code from a website so i open up the yubico authenticator which is typically already open on my desktop i find the code i want double click it touch the contact point on my ubi key and then my code is automatically copied to my clipboard and i can just paste it into the 2fa field this may not seem like much of a difference but believe me it shaves off probably 25 to 50 percent of the time required to enter in a 2fa code every time if you're constantly being prompted for 2fa codes like i am this method is much more efficient than smartphone based authenticator apps so now we know that ub keys can be used as a faster more efficient direct replacement for authenticator apps but they are so much more than that so from here we start getting into all of the various new standards for user authentication now i am by no means an expert in all of the different standards and methods of online authentication and i'm sure there are arguments to be made for many of these different flavors but some of the most promising new standards for secure authentication come from the fido alliance fido stands for fast identification online the fido alliance was originally founded by paypal lenovo and a number of other companies with the goal of working towards a secure passwordless authentication protocol later on big names like google microsoft and samsung also joined the alliance yubico's been a big part of this alliance as well the fido alliance has come out with a few different standards first is fido uaf which is seen pretty often with smartphones right so iphones for instance allow you to log into the phone and some apps with a face or finger scan there's also fido utf which is probably the most common method for using yubikeys to log into websites fido utf is where a website has built upon their existing username and password authentication by adding in local device authentication as well or in other words with fido u2f you log into a website normally with your username and password and then you're prompted for a second form of identification such as touching the contact point on your ub key which is plugged into your computer i'm going to show some examples of fido utf logins in just a little bit finally we have fido 2 so 502 is the latest specification from the fido alliance now the 10 000 foot view of fido 2 is that it uses two main components ctap and web often which honestly again i'm not an expert i'm not even sure if i'm pronouncing web often correctly it stands for web authentication so it uses ctap and web offend together to enable authentication ctap stands for client to authenticator protocol and it regulates the connection between the user's device and the authenticator device whether that authenticator is you know biometric or something like a ubi key ctap lays out a set of rules for how those devices communicate with your pc laptop or smartphone web often is the other piece of the 502 puzzle and it determines rules for how your browser takes the authentication from ctap and then uses it to log you into whatever website or service you're trying to log into so to make it as simple as possible fido 2 is made up of ctap and web often ctap uses your ubikey or other authenticator to authenticate to your pc or other device and then web often takes that authentication from your browser and uses it to securely log you into your destination the overall point of all of this technical jargon is that the fido standards are a much deeper and more secure method of authentication than one-time passcodes the ubi keys can do one-time passcodes just like authenticator apps can but they can also achieve these more secure methods of user authentication that authenticator apps cannot do or in other words if you're only using one-time passcodes for your 2fa you're missing the boat on these faster and more secure authentication methods now hundreds of companies have now adopted phyto authentication and can work with ub keys you can check out the works with yubi key catalog online to browse through all of these different companies such as 1password lastpass citrix github google twitter dropbox and vulture all right so enough of the sales pitch hopefully i've given you enough uh so that you know now that 2fa should be used wherever possible and hopefully everyone now understands that ub keys go way above and beyond what authenticator apps can do so let's actually check out ub keys in action our first example is a standard totp login i'm doing this with intuit quickbooks so we're going to log into quickbooks with lastpass first you can see i've got yubico authenticator already open on the side all right so now i'm being prompted for my six digit totp code now look at yubico authenticator one of the things that's really nice about ubico authenticator is that all of the codes are not actually displayed until you double click them and authenticate right so you actually have to have the key and you have to press the key for the code to actually be displayed but once it's displayed as soon as you tap the ubi key it's copied directly to your clipboard and you can just paste it right in so for instance we have quickbooks double-click it says touch your ubikey touch and now we have the code and i can just go paste continue and i'm logged in so let's take a quick look at ubico authenticator uh this is a good authenticator app the only sort of problem that i have with it that i actually prefer google authenticator for is that you see there's little stars here next to these items so like ubiquity networks intuit quickbooks those are favorites so basically if you star something it goes to the top of your list but what i would prefer is the ability to actually arrange your list in whatever order you would like it seems like that wouldn't be too difficult to program in and it would be much nicer if i could actually you know specifically put things in the order that i like and here we can see the yubico authenticator on my phone now it doesn't have any items listed in here right now because my ub key is nowhere near the phone nor is it plugged in but again you've got a couple of options here you've got the lightning version or which also has usb type c so for instance i can just plug in the lightning version and there we go my codes pop right up on the screen then the same thing i can just you know click on any of these codes touch the yubikey contact and then that code is displayed this also works with nfc so as you can see it says pull down to refresh or activate nfc so i'm going to pull down it says scan your yubikey we just put it to the back and now all of our codes are displayed again so these uv keys can do the totp passwords no problem whatsoever but now let's take a look at a little bit deeper uh authentication with utf okay so utf remember is where you have a username and password you log in with that information and then instead of a one-time code you have specifically set up your ub key as an authorized mechanism for authentication so the ubik then has to be it you know plugged into your computer and then you can authenticate so so here's dropbox now dropbox does u2f so we can see that i have my information pre-populated from lastpass we're going to click sign in and now i'm prompted for my pin okay so we have uh make sure it's you please enter your security pin now you don't have to put a pin on your ub key i choose to because you know the more layers of security the better so first i'm going to enter my pin i'm going to say okay and now it says touch your security key boom and now i'm logged into dropbox here's another example this is vulture so we're going to go ahead and log into vulture here so first i'm going to grab the password from lastpass and login and once again looking for two-factor authentication please enter the code generated by your mobile application your security key in this case it's a little bit different you actually have to hold down the contact for one second and a whole string of characters is going to display in that authentication code screen but again i didn't actually have to click authenticate as soon as those characters were input it automatically log me right into vulture all right one more example this is github and i believe this is a web often a type of authentication we're going to go ahead and log in to github and now we see security key go ahead and use security key and so here we say making sure it's you touch your security key boom and now logged in alright so now i know you guys are dying to get your hands on these ubi keys and go ahead and make sure you use my link below if you're going to purchase any and but how do you set it up initially well luckily i have a brand new yubikey 5ci clear ready to go these clear models were actually a special edition of these uv keys i don't remember if they're still available or not but i didn't see them on the website anymore so they might actually be gone now and so i have ubico authenticator installed and what we're going to do here is click the three dots in the upper left hand corner it says insert your ub key since i don't have usbc on the back end of my keyboard i have a usbc to usb type a adapter for the ubc uh ub key 5ci we're going to plug that into my keyboard and it found my yubi key5ci it found the serial number if i want i can set a password on this ub key and then we have a few basically application options such as you know light mode or dark mode uh you know whether you want you be yubico authenticator show up in the system tray you know stuff like that we can also delete all of the passwords on the key if we want to so if i go back now we have our key set up and that's all there is to it right it's now ready to rock and roll we're ready to receive totp or u2f or 502 authentication keys now so let's go ahead and set one up and i'll just reset one of my uh own totp 2fa keys i'm going to reset ubiquity all right so i clicked i went to account.ui.com i clicked on security and i have two factor authentication enabled so first we're going to disable two factor authentication and in order to disable it of course it wants to know what our totp code is so we're going to enter that first and now 2fa is disabled for my ubiquity account so let's go ahead and enable two factor authentication i have my brand new yubikey 5ci plugged into my keyboard into the usb type a slot we're going to turn on two factor and this is what we typically see right we say enable two-factor authentication we get a qr code and then you might have some backup codes as well it's also going to ask you for the totp token just to make sure that everything was set up properly now the nice thing with the yubico authenticator is it can detect qr codes right off the screen so when i go to click add boom it already found ubiquity networks account name and then all we have to do you can check or uncheck requiring having to touch the key to enter uh you know to show your code and we're going to click add and now i have a ubiquity networks code i can double click it touch my key and then paste it in submit and 2fa is now turned on of course here is the backup codes right so if you do need backup codes for your any of your 2fa i recommend generating backup codes and downloading them most 2fas that i've seen have the ability to do the backup codes always always save your backup codes in a nice secure location so that setup is very very simple but the one thing that i've heard from a lot of people and probably the main question that i had when i first started looking into yubikeys is what if you lose your key right so if you lose your your two-factor authentication key you're basically hosed right you have to go through your backup codes or find other ways to get back into your accounts it's going to be a real hassle to do that keep in mind though you've got the same problem with google authenticator right what if you lose your cell phone that has uh you know all of your google authenticator codes in it same thing right so again you could use something like authy which allows you to have multi-device support but for the ubi keys how do we get the same codes on multiple keys so here i am at ubiquity again we're going to actually disable two-factor authentication one more time and i'm going to show you how to set it up manually so that you can actually put these totp codes on more than one ubi key all right i've disabled the two-factor authentication now let's go ahead and enable it one more time now look here secret code so anytime you're doing 2fa i won't say anytime because i don't know if it's a 100 but most of the time when you're doing 2fa and you're setting up these totp codes there's going to be a qr code and there's also going to be a way to set it up manually or you're going to have something like this that says secret key or secret code something like that right so to do it manually now let's go ahead and grab this code we're going to copy it i'm going to bring up the yubico authenticator i'm going to delete the one that i already have in here and we're going to add a new one now i have this qr code on the screen right so if i click add it's going to automatically you know grab that qr code so i actually want to minimize this screen we're going to go back we're going to minimize the screen and then we're going to click add this time it's not going to automatically detect the qr code since it's not actually displayed on the screen but instead of saying scan or bring up the qr code i'm going to click manual so for issuer i'm just going to say ubiquity account name i'll just say ubiquity and then i'm going to paste in that security key that i grabbed manually off of the 2fa setup on the ubiquiti website and we're going to click add so there we go i have it set up but now i'm going to pull my ub key out of the computer and i'm gonna put in a different uv key all right so my different yubikey i have already deleted ubiquity out of this one we're going to add again a second one manual same thing ubiquity ubiquity paste the secret key and add and now we can see that ubiquity is on two ub keys so my totp code is on two ub keys now what i like to do is i have my main ub key here and i keep this one on my keychain the other one so anytime i'm setting up a new totp 2fa i do it in both places and then i keep my second one in my safe right i've got a safe in my closet in my master bedroom that's where i keep this other key i keep it nice and secured so that if i ever need it i'm gonna have it like if i ever lose this one but as an added measure for if i lose this thing i've also got a tile okay so i i was very concerned about losing this uv key when i first got it so tile is a nice way to find your stuff if you lost it like i've got a tile on my bike in case someone steals it for instance right so this tile allows me to through my phone not only locate the tile on gps but if i want to and i need to locate it like this literally just happened two nights ago where i couldn't find my keys i had set them down in some weird place and i didn't know where i put them i needed my yubikey to log into something so i went into tile and then i just clicked find next to where it says keys right and then it makes this you know cute little noise you can also do it vice versa if you lose your cell phone and you have your tile you can double click the tile and your cell phone will all right enough and your cell phone will start ringing even if the cell phone is in silent mode as it is right now because i'm recording a video so nice little solution and just sort of the icing on the cake for making sure that you don't lose your yubi keys okay which by the way i had two yubikey 5 nfcs i did lose one i lost the one that's not on this keychain when i moved to this new house i still have yet to find it i don't know where it goes and i even have this like super cool skin for it you can see i've got like the geode skin on this yubi key and i have this other super cool skin for my other yubikey 5 nfc but i lost to the second one i don't know where it is i'm sure it'll turn up someday it's probably just in a box somewhere that i haven't yet unpacked but so if you do lose a ubi key you can have a backup and you can use something like tile i recommend using something like tile to make sure you can always locate it that's how you set up the totp stuff right but how do you actually set up a u2f type of authentication well let's look at dropbox so here here i have my dropbox account and if we look at security keys we can see that i have two keys showing so if i click edit we can see that i've got a ubi key5 nfc and a ubi key 5ci so what i can do here is let's go ahead and delete out both of these keys and so now even though i have actually removed the the two ub keys from my dropbox account i can actually still use totp to log into dropbox like if i only had google authenticator that's my only option right but i don't want to just use totp i want to use the higher level and more an easier way of doing you know password authentication when a website allows it so like i said dropbox lets me do u2f let's go ahead and set it up so i've already set up the authenticator now let's add our security keys we're going to click add and it says add security key a security key allows you to complete two-step verification securely and conveniently when lobbying logging into dropbox we're going to say begin setup and then we're going to put in our password and now we're going to plug in our security key we're going to click key inserted it's going to scan it here we go making sure it's you set up your security key to sign into dropbox as my email address this request comes from chrome published by google llc touch your security key we touch it allow this site to see your security key yes and key added so now we're going to say yubikey 5 ci and we're going to click finish now we can see i have one key let's go ahead and add a second key so again this is where a lot of sites i've seen will allow you to do up to like five keys so remember with totp it was a manual process where we had to go through and individually set up each key we had to set up those time codes on each key we couldn't use the qr method we had to do the manual method of setting those up with utf there's an advantage in that utf is already built for multiple keys in most cases so now we're going to go edit add a new key begin setup i have my new key plugged in already we're going to enter our password next okay start by inserting security key it's already inserted all right enter your security key pin right so this key has a pin for utf whereas i haven't set up a pin on that other one yet so we're going to enter our pin and click ok touch your security key allow it and then we're going to name it ub key 5 nfc and finish all done now so if i go back to my keys and click edit here we can see i have my two separate keys all set up let's go ahead and log out and we're going to log back in there we go making sure it's you enter your pin okay touch your key and now we're logged in next a little bit of q a i had put a question out on twitter telling people that i'm doing a video on yubi keys and what questions do people have and a few people asked about windows login right so can you use a yubi key to log into windows the answer is yes you can there's a bunch of different ways to do it and if you look at this web page here this is the uh protect data with secure access to computers okay this talks about how you can use apps or or natively log into windows depending on how you're actually logging in so the first one is local accounts right so this is if you have windows hello or just a local account on your laptop or something like that something that's not connected to active directory they have something called the yubico login application right so you install yubico login and that allows you to log in securely with your ub key to a local computer account in windows now if you have active directory there's two types of active directory you've got azure active directory that's like the newer flavor right so azure active directory supports fido 2. so you can do passwordless authentication into windows into azure active directory using fido 2 with your yubi key if you want it i wouldn't recommend doing password lists because then anyone you know who has your ub key can just plug it in and it's good to go so what i would recommend is ub keys with a pin code in order to log into azure active directory if you're using old school active directory you can also set up yubi keys for login using the built-in smart card functionality and then finally you can also set it up for microsoft accounts of use your microsoft account to log into windows if you put yubikey security uh 2fa security on your microsoft account it will also prompt you for your ub key just when you're logging into your computer with like a hotmail connected account or whatever it is you know microsoft account they also have smart card authentication for macs and again i will put a link to this page down below in the description if you want to check it out another common question was will the ubi key work with any site that offers totp right so the time-based one-time password authentication and the answer is yes okay i have yet to find a site that it won't work on it works exactly the same as google authenticator or offi or any of the other you know otp apps that are out there and you can store up to 32 totp keys on a single ubi key and that might be a limiting factor for some people but like i turned 2fa on like wherever i can and i've got less than 20 uh accounts on my ub key in addition you also have the fido 502 and fido utf keys where you can store up to 25 of those right so for me i use utf with dropbox i use it for lastpass i use it for vulture i think a couple others too that i can't remember off the top of my head but you've got sort of separate stores for your one-time passwords versus your fido based passwords as well all right what about the different types of ubi keys available now as far as the ubi keys there's a few different classes of yubi keys there's one like there's ones that are specifically for security there's ones that are geared towards other things besides you know totp passwords and fido passwords but here's sort of their lineup right so you've got the uv key 5 nfc that's this one here that i have on my keychain then you have the yubikey 5 nano which is basically the yubikey 5 nfc but in a very small form factor they have the yubikey 5c which is the same thing but it is just a usb type c connector then you have the 5c nano which is a very teeny tiny one you've got the yubikey 5ci which is this clear one that i have right here again i don't think the clear ones are available anymore but this is lightning on one side for your iphone or ipad and then usb type c on the other side and then finally the newest member is the yubikey 5c nfc which is basically like my usb type a nfc ub key but it's a usb type c plus nfc so that you can do the you know proximity authentication to your iphone or android all right so there you have it there is my overview of the yubico ubi key lineup i absolutely love these things i'm not going to switch back off of them mostly because i absolutely love the phytoauthentication and i try to set that up wherever i absolutely can in fact i wish more and more websites would start adopting phytoauthentication so that i can use the these keys a little bit easier than even doing the totp one-time password authentication if you guys have questions about uv keys put those down in the comments below i will try to get those answered as best i can again i'm not an expert but i know some experts and they can hopefully help answer any questions that you guys have also if you guys use yubi keys i'd love to hear your feedback put that down in the comments below again there's a thousand ways to skin every cat in it but this is a really nice solution for security right i i gotta hand it to yubico they've made a really nice product here and again if you guys are interested in buying some of these link down below that's an affiliate link gets me a couple bucks but doesn't change your price at all and i appreciate any affiliate sales that we received all right that's going to do it for this one if you guys enjoyed this video make sure you give me a thumbs up if you'd like to see more videos like this please click subscribe my name is chris with crosstalk solutions and thank you so much for watching

Channel: Crosstalk Solutions

Views: 543,854

Keywords: crosstalk, crosstalk solutions, yubikey, yubikeys, yubico, yubikey 5 nfc, yubikey 5ci, yubikey windows 10 login, yubikey 5 nfc iphone, yubikey 5c nfc, yubikey iphone, yubikey 5, yubikey setup, yubikey 5c, yubikey nfc, yubikey review, yubikey 5 nano, yubikey 1password, cyber security training for beginners, two factor authentication, high security keys, 2fa, u2f, FIDO, FIDO2, FIDO U2F, FIDO alliance

Id: ybn9J4QCqK4

Length: 34min 34sec (2074 seconds)

Published: Wed Oct 28 2020

Reddit Comments

[u/Gyilkos91]

You can also use it to further secure your password manager and you can use it as an additional security for your authenticator codes.

And the best part for me is to use it for GPG and SSH.

[u/Markqz]

All the apps I could find that accept Yubikey were "play" entities -- google, reddit, github, facebook. So, my open source code that is available to anyone can be locked down securely. Yipee. Oh, and google wants a backdoor SMS, so actual security isn't that much better.

Who doesn't accept Yubikey? Banks, paypal, ebay, amazon -- anything having to do with money. The things we would like most to be protected. Get these guys onboard and you won't have to convince you-tubers to generate marketing material.