# Put a physical key on your accounts

> AI has widened the attack surface and made phishing more effective, and text-message and app codes can be stolen through a fake site. A physical key can’t: which one to buy, which accounts to put it on, and what to do if you lose it.

- URL: https://stocasticparrot.ai/en/security/yubikey/
- Author: Danilo Giudice
- Published: 2026-11-06

![Put a physical key on your accounts: the duo points at a YubiKey floating among the bubbles 2FA, MFA, FIDO2, passkey, and no SMS](https://stocasticparrot.ai/en/security/yubikey/img/01-apertura.jpg)

## Backstory

*I recently bought two YubiKeys and registered them on the accounts that would ruin me if someone stole them: my password manager, my email, and my social accounts.*

## What to do right now

1. **Today.** Turn on two-step verification on every account, with an authenticator app or a passkey. Never with text messages (SMS).
2. **Today.** Remove your phone number from verification and recovery, wherever the service lets you.
3. **This week.** Buy three new keys from the [Yubico store](https://www.yubico.com/store/). The [Security Key C NFC](https://www.yubico.com/product/security-key-c-nfc-by-yubico-black/) is enough, at €35.38 each; the [YubiKey 5C NFC](https://www.yubico.com/product/yubikey-5c-nfc/), at €70.76, adds six-digit codes (prices on Yubico’s Italian store, VAT included).
4. **When they arrive.** Set a PIN with [Yubico Authenticator](https://www.yubico.com/products/yubico-authenticator/) and register all three keys: your email first, then your password manager, then everything else. [Yubico’s setup guide](https://www.yubico.com/setup/) shows where to find the option.
5. **Right after.** Print your recovery codes and keep them outside your password manager.
6. **Always.** One key on your key ring, always with you; the other two in two separate, well-protected places. If you lose one, remove it from every account right away.

## Why now

AI has widened the attack surface, meaning all the ways someone can try to get in: messages, phone calls, and video calls with generated voices and faces. And it has made phishing, the message that lures you to a fake site, as effective as an expert’s ([Heiding, Schneier, and others](https://arxiv.org/abs/2412.00586)).

![Clicks on tailored phishing emails: 12% generic, 54% experts, 54% AI only, 56% AI plus human](https://stocasticparrot.ai/en/security/yubikey/img/02-clic.jpg)

Attackers have adapted. According to the [2026 Microsoft Digital Defense Report](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/2026-Microsoft-Digital-Defense-Report.pdf), password-only attacks fell 26% in a year, and 44.6% of phishing techniques use kits that steal your codes too. In a campaign described by [Anthropic](https://www.anthropic.com/news/disrupting-AI-espionage), AI carried out 80–90% of the work. In Italy, in the first half of 2026, phishing incidents had already reached two-thirds of the total for all of 2025 ([Clusit](https://clusit.it/wp-content/uploads/download/Rapporto_Clusit_aggiornamento_10-2026_web.pdf)).

## Your email is the safe

![Whoever has your email has everything: logins, password resets, passkeys, photos, and documents all go through your Google or Apple email](https://stocasticparrot.ai/en/security/yubikey/img/03-mail.jpg)

We used our Google or Apple email to sign up for everything: password resets land there, and “Sign in with Google” and “Sign in with Apple” run through it. If someone steals that, we’re screwed. Your first YubiKey gets set up there.

## Why not your phone number

![From weakest to strongest: SMS and calls, app code, push notification, passkey, physical key](https://stocasticparrot.ai/en/security/yubikey/img/04-scala.jpg)

With a *SIM swap*, an attacker pretends to be you and convinces your carrier to move your number to their SIM: your codes and password resets go to them. And sometimes we type the codes ourselves, but on a fake site we believe is real, and the fake site passes them straight to the real one.

A YubiKey, on the other hand, is tied to the real site and will never work on the fake one. In 2022, three [Cloudflare](https://blog.cloudflare.com/2022-07-sms-phishing-attacks/) employees typed their credentials into a fake site, and nothing happened: they all signed in with a physical key.

## What a YubiKey is and how it works

A YubiKey is a small key with no battery that lives on your key ring and holds your sign-in keys: only it can use them, and they can’t be copied. You plug it into your computer or phone through USB-C, or tap it on your phone over NFC.

![What’s inside a YubiKey: ring hole, gold contact, USB-C, NFC antenna, secure element, PIN and memory](https://stocasticparrot.ai/en/security/yubikey/img/06-anatomia.jpg)

When you register it on a site, the key creates a key pair just for that site: only the key can use the private one, and the public one goes to the site. Every time you sign in, the site sends a request to sign. You touch the gold contact, which confirms that a person is there and not a program, and the key signs, but only if the address is the one it registered. You don’t type anything, so there’s nothing to steal.

**The parts, one by one**

- **Gold contact.** It’s a sensor, not a button: it has no moving parts. Touching it tells the key that a person is there and not a program, the “user presence” check in the FIDO standard. The waves above the “y” mean NFC.
- **USB-C.** It carries power and data, because the key [has no battery](https://www.yubico.com/product/yubikey-5c-nfc/). Browsers and operating systems recognize it on their own through the WebAuthn standard, with no drivers or apps.
- **NFC antenna.** It sits inside the case: you tap the key on the back of your phone, and the exchange happens by radio, a few centimeters away.
- **Secure element.** The chip that creates the keys and signs requests inside itself: the secrets never leave, and the firmware [can’t be rewritten](https://www.yubico.com/support/security-advisories/ysa-2024-03/), not even by Yubico.
- **PIN and memory.** Today’s YubiKeys hold up to 100 passkeys. You choose the PIN: [after 8 wrong attempts](https://docs.yubico.com/software/yubikey/tools/authenticator/auth-guide/fido2.html), the FIDO part locks and has to be reset, passkeys included.
- **Ring hole and case.** Glass-fiber reinforced plastic, IP68 against water and dust, and crush resistant: it’s built to live on your key ring.

## Key or passkey?

A passkey is the same technology, saved on your phone or in your password manager, and for most accounts it’s enough. But it’s only as safe as the account that syncs it, which is usually your email. My rule: a physical key on your email and password manager, passkeys on everything else.

Where they work, as of November 5, 2026 (“—” means not listed):

| Service | Physical key | Passkey |
|---|---|---|
| [Google and Gmail](https://support.google.com/accounts/answer/6103523?hl=en) | yes | yes |
| [Apple](https://support.apple.com/en-us/102637) | yes, at least two | — |
| [Microsoft and Outlook](https://support.microsoft.com/en-us/accounts-billing/security/create-save-passkey) | yes | yes |
| [1Password](https://support.1password.com/security-key/) | yes | — |
| [Bitwarden](https://bitwarden.com/help/setup-two-step-login-fido/) | yes, even on the free plan | — |
| [Facebook](https://about.fb.com/news/2021/03/expanding-support-for-security-keys-on-mobile-devices/) | yes | yes |
| [Instagram](https://about.fb.com/news/2026/04/meta-account/) | — | only if linked to Facebook |
| [WhatsApp](https://faq.whatsapp.com/1850567238795036/) | — | yes |
| [LinkedIn](https://www.linkedin.com/help/linkedin/answer/a1621596) | — | yes |
| [X](https://help.x.com/en/managing-your-account/two-factor-authentication) | yes | yes |

## The rules everyone repeats

The ones from the [Cyber Aware](https://www.ncsc.gov.uk/cyberaware/home) campaign by the UK’s cybersecurity agency, plus a few of mine:

1. A different password for every account, in a password manager.
2. For your email, a strong password used only there.
3. Two-step verification everywhere, without a phone number.
4. Automatic updates for your system, browser, and apps.
5. A backup of your photos and documents off your computer.
6. When something is urgent, check through another channel: in 2024, an Arup employee transferred about $25 million after a video call with colleagues generated by AI ([CNN](https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk)).
7. Check whether your email is already out there on [Have I Been Pwned](https://haveibeenpwned.com/).
8. Three YubiKeys: one on your key ring, always with you, and the other two in two separate, well-protected places.

## The limits

- **If you lose all of them**, you can be locked out of your account for good, as [Apple](https://support.apple.com/en-us/102637) warns. NON-NEGOTIABLE: three keys, registered the same day, and printed recovery codes.
- **EUCLEAK:** YubiKeys with firmware older than 5.7 can be cloned, but it takes the key in hand and about €10,000 of equipment ([NinjaLab](https://ninjalab.io/eucleak/)). The ones sold today ship with 5.8.
- **Not everywhere:** on Instagram, WhatsApp, and LinkedIn, physical keys aren’t listed, and I couldn’t find confirmation for Italian banks.

## Three keys against a language model

My advice is simple: everyone out there wants to screw you over, at any moment. Getting three keys would be ideal: one always with you, and two in separate safes, in different homes, to spread the risk. Our digital lives are more at risk than ever with the rise of LLMs: protecting yourself has never mattered more.

## Sources

Facts checked on November 5, 2026; prices and services change.

- F. Heiding, B. Schneier, and others, [“Evaluating Large Language Models’ Capability to Launch Fully Automated Spear Phishing Campaigns”](https://arxiv.org/abs/2412.00586), arXiv, 2024; *Expert Systems with Applications*, 2026.
- Microsoft, [“2026 Microsoft Digital Defense Report”](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/2026-Microsoft-Digital-Defense-Report.pdf), October 2026 (pp. 45 and 64).
- Anthropic, [“Disrupting the first reported AI-orchestrated cyber espionage campaign”](https://www.anthropic.com/news/disrupting-AI-espionage), November 13, 2025.
- Clusit (the Italian information security association), [Clusit Report, October 2026 update](https://clusit.it/wp-content/uploads/download/Rapporto_Clusit_aggiornamento_10-2026_web.pdf), in Italian.
- NIST, [SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html), July 2025.
- Cloudflare, [“The mechanics of a sophisticated phishing scam and how we stopped it”](https://blog.cloudflare.com/2022-07-sms-phishing-attacks/), August 9, 2022.
- NCSC, [“Cyber Aware”](https://www.ncsc.gov.uk/cyberaware/home).
- CNN, [“British engineering giant Arup revealed as $25 million deepfake scam victim”](https://edition.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk), May 16, 2024.
- Yubico, [FIDO2 PIN guide](https://docs.yubico.com/software/yubikey/tools/authenticator/auth-guide/fido2.html), [YubiKey 5C NFC page](https://www.yubico.com/product/yubikey-5c-nfc/) (no batteries, USB-C and NFC, IP68), [store](https://www.yubico.com/store/), [setup guide](https://www.yubico.com/setup/), and [advisory YSA-2024-03](https://www.yubico.com/support/security-advisories/ysa-2024-03/); NinjaLab, [“EUCLEAK”](https://ninjalab.io/eucleak/), 2024.
- The help pages of the services linked in the table.