something you can hold

a password is a string you can type, which means a string you can leak. a yubikey is a secret you cannot type, cannot read, and cannot extract. it answers challenges without ever revealing the key.

what a hardware key changes

authentication has three factors: something you know (password), something you have (key), something you are (biometric). the industry spent twenty years hardening the first factor and ignored the second. the result was phishing, replay, credential stuffing. every attack against a secret that lives in memory.

a hardware key moves the secret out of memory and into a chip that will bricker itself before it gives the key up. you cannot phish what the user does not know.

FIDO2 and TOTP

FIDO2 / WebAuthn is the one to care about. the browser sends the origin to the key, the key signs a challenge scoped to that origin. a credential minted for seer.cx will not sign for seеr.cx (note the cyrillic е). the phishing page gets a public key it cannot use. the secret stayed in your pocket.

this is not TOTP. TOTP (the six-digit code) is a shared secret. both sides know it, and either side can leak it. FIDO2 is asymmetric. the server stores a public key. the key stores the private half. they never meet.

ssh from a yubikey

the yubikey speaks OpenPGP smartcard. the private key lives on the device; the host sees a reader. add the right stanza to ~/.ssh/config:

PKCS11Provider /usr/lib/x86-64-opensc-pkcs11.so

or, with the newer sk-…@openssh.com key type, generate resident keys directly:

ssh-keygen -t ed25519-sk -C "yubikey ssh"

the key never touches disk. remove the yubikey, walk away, and the ssh agent has nothing to offer.

git signing

the same OpenPGP slot signs commits. the gitea pr workflow on this site signs every commit with an ed25519 key. a yubikey-backed signing subkey means the signing operation requires the physical key. the agent cannot sign without the human who holds it.

% gpg --list-secret-keys --keyid-format=long
ssb>  ed25519/0xDEADBEEF  created: 2026-01-01  card-no: 0006 12345678

the > means the key is on the card. card-no is the yubikey serial. the secret is not in the keyring. it is in the thing on your keychain.

limits

a yubikey does not protect against an attacker who owns your machine while the key is inserted. the session is live, and live sessions trust the host. it protects against theft of the credential at rest, against phishing, and against the database dump. it raises the cost of remote compromise from a curl command to a visit.

two keys. one on the keychain, one in the safe. register both to every account that matters. a single hardware key is a single point of failure.

key custody

the yubikey puts that custody rule in hardware: the private key stays on the device while you carry it.