Editors’ Choice Security

February 2020

YubiKey 5 NFC

Review by Dr. Terry Kibiloski

In this day and age, when more and more of our lives are spent online, and our digital fingerprints are ever expanding, securing all of our digital data has become more important than ever.  We all log in to multiple online services everyday, be that Facebook, Google, Dropbox, or any number of others.  How many of us have had to change the passwords over all of our services, because one of them was hacked?  Multiple layers of security, beyond just having a solid password, are encouraged by online security professionals, to prevent this from ever happening again.  This is where physical security keys come into play, like the YubiKey 5 NFC (Retail $45), from Yubico.

If you’re new to hardware security keys, it’s important to note that Yubico has a storied history in this field.  They pioneered the design of the first one-time password authenticator, that works with a simple touch, and with no client software.  They made it compatible with the open authentication standard OATH, which was produced by an industry-wide collaboration of security vendors for the universal adoption of strong authentication. Yubico further secured and simplified the PIV (Personal Identity Verification) smart card standard by adding touch-to-sign and built-in attestation, which lets you know that applications comply with security standards. Then, in close collaboration with Google and Microsoft, they co-created the FIDO (Fast Identity Online), Universal 2nd Factor (U2F), and FIDO 2 open authentication standards.

Their specific device that we’re featuring today is the YubiKey 5 NFC.  It supports the NFC (Near-Field Communication) set of communication protocols, that enable two electronic devices to establish communication by bringing them within 4 cm (1¹⁄₂ in) of each other. This allows the YubiKey 5 NFC to communicate with a smartphone by simply touching it to the back where the NFC antenna is located. For desktops, and other devices with a USB port, the YubiKey 5 NFC can simply be plugged in for personal identity verification, and then touched to show that you’re really there.  There are several other versions of YubiKey (Your ubiquitous key) available to securely access a host of compatible IT systems, with the YubiKey 5 Series being the most recent.  The model you choose will depend on the devices you use and your individual online security needs.  You can compare them all on the Yubico product site, and get started securing your online life.

Sounds pretty cool, but why would you need a YubiKey in the first place?  This type of product is a good choice because it makes personal identity verification easier and more secure. Let’s take a typical connection you’re trying to make with your PC, to check your company email or your banking information, sans a YubiKey. You may have your user ID and password saved on your computer for your login. Then, you get a popup window on your PC that says a verification code has been sent to you via text, or in the case of your bank, it could have been sent to your email. You then need to find the text message, or the email with the verification code, and type it into the popup window so your identity can be verified. Not only can this get annoying, if a hacker has access to your phone, or your email, the verification code could easily be compromised.

With the YubiKey 5 NFC, or any other YubiKey model, which you could have attached to your keychain, your personal or corporate lanyard, or kept in some other secure location, there’s another layer of security that cannot be compromised by a remote hacker.  When you set up your various accounts to use two-factor authentication (password and a security key, which you’ll set as your YubiKey) you’ve made accessing your accounts more convenient and more secure. This is more convenient because you don’t have to obtain a security code to verify your identity, and more secure because a hacker would need physical possession of your YubiKey in order to access your accounts.

In Japanese, the word “yubi” means “finger”, and by touching the YubiKey with your finger, you verify your human presence, and that you’re not a remote hacker.  With the addition of this simple yet effective device, you can add another layer of protection for yourself and your digital data.  Yubico‘s growing catalog of YubiKey products, enabled by open standards, is the top of the line in hardware security keys.  Online protection is important, so go check out the YubiKey 5 NFC, and all of Yubico‘s other products today.