monthly password rotations, enforcing complicated characters. Also, it does not help that there are deeply ingrained misconceptions and bad practices about what makes a strong password a strong password, e.g. The problem is that humans are notoriously bad at choosing and remembering strong passwords. In a world without security tokens, you’re relying on your password alone to keep you secure. This is a great start, because using a Yubikey in this way makes it impossible for someone who does not physically possess the Yubikey to hack your account. Here’s what most of you will start their journey into the land of the Yubikey with: You use the Yubikey as a second factor to make your email account more secure. Log into websites with passwords and touching your Yubikey The instructions get incrementally more challenging with each point, so if you wanna leave step off the ride somewhere in between, that’s cool. En-/Decrypt mail in Gmail with PGP keys stored in your Yubikey.

Connect to remote servers with SSH keys stored in your Yubikey.Control what happens when you touch the Yubikey.Lock your Mac when pulling off the Yubikey.Log into websites without passwords using only your Yubikey.Log into websites with passwords and a six-digit passcode that changes every 30 seconds.Log into websites with passwords and touching your Yubikey.Paths are different between Apple Silicon and Intel Macs. Other operating systems have slightly different setups. You’re on macOS on Apple Silicon architecture.If you wanna dive deeper as the post goes on, I will assume: Not full blown tin floil hat, but you’re interested. And most likely you’ve taken the key out of the packaging and wondered: What am I supposed to do with this now?!

So this one is for the folks who bought a Yubikey based on slightly overenthusiastic recommendations of friends or colleagues.