A YubiKey is a hardware security key manufactured by Yubico, a Swedish company founded in 2007 with offices in Stockholm and Palo Alto. The key implements multiple authentication protocols (FIDO2/WebAuthn, U2F, smart card, OpenPGP, OATH-TOTP, OATH-HOTP, static password) on a single USB or NFC device. The current main lines are the YubiKey 5 series (USB-A, USB-C, Lightning, NFC variants) priced around $50 to $80.
What it means in practice
The cryptographic property that makes hardware keys phishing-resistant is domain binding. When you register a YubiKey with example.com, the key generates a keypair specific to example.com. A phishing site at exampie.com (with an i instead of an l) cannot use that credential because the browser passes the actual origin to the key, the key checks the origin matches the registration, the signature is refused. This is the structural defense that TOTP and SMS cannot replicate. The trade-off: you carry a physical object, you can lose it, you need a backup. The operational rule is always: enroll two keys per account, store the backup in a physically separate location, and do not enroll a single key on accounts where loss equals lockout (which is most accounts worth securing).
Who uses it, and against whom
Customer base spans security professionals (Google migrated all 85,000 employees to YubiKeys in 2017 and reported zero successful phishing-driven account compromises since), high-profile journalists, lawyers protecting privileged accounts, finance staff approving wire transfers, and increasingly mainstream users following the FIDO Alliance push toward passkeys. Adversaries: account-takeover crews running phishing kits (defeated by domain binding), credential-stuffing operators (irrelevant against hardware-key 2FA), and SIM-swap operators (also irrelevant). The categories where YubiKey does not help: malware on the unlocked device after authentication, physical seizure of the key plus the password, and supply-chain compromise (Yubico has had no documented supply-chain incident; the threat exists in theory).
What you can change today
Buy two YubiKey 5 NFC keys (around $100 total). Enroll both on: primary email account (Gmail Security, Microsoft Account Security Info, Proton Account Security), password manager (Bitwarden Two-step Login, 1Password Security, Proton Pass), GitHub or GitLab if you have any code repository, AWS or Cloudflare or any production infrastructure. Carry one on your keychain, store the second in a physically separate location. For each enrolled account, download and print recovery codes as a third fallback. Total time investment: 90 minutes. Total annual maintenance: zero unless you lose a key.
Related articles
- Three breaches in ten days. In two of them, the attacker never wrote a line of code.
- Digital security for journalists in 2026: the complete operational guide.
- 1Password review for journalists. Is it enough for source protection?
- Most journalists are compromised before they know they’re being watched.