A hardware security key is a physical token (YubiKey, Titan, Nitrokey, SoloKey) that performs FIDO2/WebAuthn or U2F authentication. Phishing-resistant by cryptographic design: the protocol binds each registered credential to the actual domain origin, so a phishing site cannot harvest the credential even if the user is tricked into “approving” the login. The 2FA tier above TOTP and well above SMS.
What it means in practice
The cryptographic property is what differentiates hardware keys from every other 2FA option. When you register a YubiKey at github.com, the key generates a keypair specific to github.com. A phishing site at githab.com (homoglyph) cannot use that credential because the browser passes the actual origin to the key, the key checks the origin against the registration record, and the cryptographic signature is refused. TOTP codes can be phished in real time (the user types the code on the fake site, the kit relays it). Push-based 2FA can be defeated by MFA fatigue. Hardware keys are the only consumer-grade 2FA that survives a sophisticated phishing campaign by structural design rather than user vigilance.
Who uses it, and against whom
Standard practice for: security-conscious enterprises (Google migrated all 85,000+ employees to YubiKeys in 2017 and reported zero successful phishing-driven account compromises since), high-target individuals (Edward Snowden, prominent journalists, executives), open-source maintainers signing releases, and increasingly mainstream users following the FIDO Alliance push toward passkeys. Against whom: account-takeover crews running phishing kits (defeated by domain binding), credential-stuffing operators (irrelevant against hardware-key 2FA), SIM-swap operators (also irrelevant). What hardware keys do not defend against: malware on the unlocked device after authentication, physical seizure of both the key and the password, and (theoretically) supply-chain compromise of the key vendor.
What you can change today
Buy two YubiKey 5 NFC keys (around $100 total). Enroll both on your primary email account, your password manager, your code-hosting account if applicable (GitHub, GitLab, Bitbucket), your cloud-infrastructure provider (AWS, GCP, Cloudflare), and any other keystone account that supports FIDO2. Carry one on your keychain or in your daily-carry, store the second in a physically separate location (safe deposit box, parent’s house, work locker). Generate and print recovery codes for each enrolled account as a third fallback. Total time investment: 90 minutes once. Annual maintenance: zero unless you lose a key.
Related articles
- Three breaches in ten days. In two of them, the attacker never wrote a line of code.
- Digital security for journalists in 2026: the complete operational guide.
- 1Password review for journalists. Is it enough for source protection?
- Most journalists are compromised before they know they’re being watched.