Hardware Security Keys: Why Use a YubiKey—and When Not To

What is a YubiKey or hardware security key?

A YubiKey is a brand of dedicated security authenticator made by Yubico. Other companies make FIDO2 hardware security keys too. These compact devices typically connect through USB-A, USB-C, or NFC. You plug the key into a computer or tap a compatible phone and confirm sign-in by touching the key, entering a PIN, or using a model with a biometric sensor.

A FIDO2 security key uses cryptography tied to the legitimate site. It protects the private key that proves you hold the credential. It is not a USB storage drive full of passwords, and it will not automatically secure every account you own. Each supported service must be set up to trust that security key.

A hardware security key may be used for phishing-resistant multi-factor authentication alongside a password or for passwordless authentication with a device-bound passkey. Some models add smart-card or one-time-password features, but this guide focuses on FIDO2/WebAuthn.

Hardware security key vs. a passkey on your phone

A well-implemented synced passkey is already phishing resistant. A dedicated hardware key's main advantages are device-bound control, separation from the everyday phone or computer, and suitability for certain high-assurance policies—not that synced passkeys are inherently easy to phish. See Microsoft's passkey guidance.

How to set up and use a hardware key

1. Check compatibility. Your identity provider and target app must support FIDO2/WebAuthn. A Microsoft Entra administrator may need to enable the passkey (FIDO2) method before an employee can register a key.
2. Choose the right hardware. Check USB-C, USB-A, and NFC support, operating systems, browsers, accessibility needs, and mobile app compatibility.
3. Enroll a primary and backup key. Register each physical key independently with the relevant accounts. A passkey stored on one physical key cannot simply be copied onto another. Store the spare securely away from the primary.
4. Register for Microsoft 365. Where your organization's configuration supports it, open mysignins.microsoft.com/security-info, choose Add sign-in method and Passkey, and select the security-key option as directed. Insert or tap the key and finish the PIN/fingerprint and touch prompts.
5. Test everyday sign-in. Choose the security-key method in sign-in options, connect or tap the key, and complete its PIN/biometric or touch confirmation.
6. Document recovery. If a key is lost, report the loss, remove the credential from affected accounts, use a previously registered spare or approved recovery method, and register a replacement. Never assume a lost key can be copied or remotely located.

Microsoft's FIDO2 registration instructions and sign-in instructions show the current process. Yubico's FIDO2 documentation explains key PINs and credential management. Screen labels and prompts may vary by device and policy.

Safety tip: Enter the key's PIN only in a legitimate operating-system or authenticator prompt, not into an unexpected web form requesting your PIN.

Real example 1: Cloudflare stopped a phishing attack

In July 2022, attackers ran a sophisticated phishing campaign against Cloudflare employees. Cloudflare reported that three employees entered credentials into a fake login page. Even with those credentials, the attackers could not complete the login because Cloudflare required origin-bound FIDO2 hardware security keys. Cloudflare also reported those employees did not proceed to the later remote-access payload step.

This is a documented public incident, not a Blue Tree Technology® customer example. It shows why a phishing-resistant authentication method matters even when a person falls for a convincing message.

Verify in Cloudflare's incident report: The mechanics of a sophisticated phishing scam and how we stopped it (2022) →

Real example 2: Google's employee security-key program

Google reported in August 2018 that after requiring FIDO security keys as a second factor for employees, it had seen no reported or confirmed employee account takeovers due to password phishing. That was Google's report at that time, not evidence that a hardware key stops every kind of cyberattack or a claim about results in other workplaces.

Verify in Google's 2018 announcement: Titan Security Keys — now available on the Google Store →

Who benefits most? Three common business situations

1. A Microsoft 365 global administrator

If attackers learn an administrator's password, an authentication policy requiring a registered FIDO2 key makes remote phishing sign-in substantially harder. Continue to use least-privilege access, separately protected recovery, and account monitoring.

2. A controller authorizing payments

A physical key can reduce the risk that somebody takes over an account after sending the controller a fake sign-in link. It cannot tell whether a payment instruction, invoice, or bank-detail change is fraudulent; financial verification procedures still matter.

3. A law or CPA firm handling confidential records

For privileged accounts that access sensitive client records, a dedicated key can make it easier to control which authenticators hold the sign-in credential—as long as each user has a backup and support process.

These are illustrative business-planning scenarios, not claims about specific Blue Tree Technology® clients.

Practical recommendation by role

• Highly privileged administrators and sensitive finance access: strongly consider dedicated device-bound FIDO2 security keys with a spare.
• Executives frequently targeted by phishing: consider keys for critical identity, email, and financial access.
• Typical employees using managed laptops and phones: a supported synced or device-bound passkey may provide strong phishing resistance with less complexity.
• Teams dependent on older systems: confirm support before buying keys, and use the strongest compatible sign-in control while planning upgrades.

Why a physical security key may be the wrong choice

• Cost and logistics: purchasing, enrolling, tracking, replacing, and sometimes shipping two devices per person adds expense and administrative work.
• Lost or damaged devices: without a registered backup or secure help-desk recovery process, employees could be locked out when they most need access.
• Compatibility and accessibility: unsupported applications, USB ports, NFC, remote-desktop setups, phone restrictions, and accessibility needs can complicate daily use.
• Unnecessary friction for common accounts: a synced passkey can be both convenient and resistant to conventional login phishing. Hardware keys are not automatically better for every employee.
• A false sense of security: keys do not stop malware on an already-compromised device, stolen live sessions, weak recovery channels, or fraudulent actions after a legitimate sign-in.

For teams with shared devices or poor account ownership, fix individual identities, recovery practices, and device protections before enforcing physical keys.

A practical deployment policy

1. Pilot with administrators, finance approvers, and other high-impact accounts before considering a broad mandate.
2. Register a primary and a separately stored backup key for each important account, and test the recovery process.
3. Enforce phishing-resistant sign-in at the identity provider where possible. Review password, SMS, or help-desk fallback routes that could weaken the policy.
4. Keep an up-to-date inventory, lost-key revocation procedure, and offboarding process for every account where the key is registered.
5. Check device compatibility, accessibility accommodations, remote access, training needs, and help-desk workload before expanding.

Bottom line: hardware keys are a powerful option when the potential impact of account takeover justifies extra controls. For many everyday employees, a well-managed passkey on a trusted device is the better balance.

Related reading: Passkeys Explained: Why They Are Safer Than Passwords.