Use of usb security key(s)

TidBITS Talk
1

I note some banks require use of USB security keys for some major transactions when a mobile phone is not used or available or when using a desktop computer ( sequoia for example ) which must be Fido2 compatible, etc.

But to use on my mini(s) it seems to require TWO USB keys to set up the appropriate passkey, etc
but not on an iphone. . .

But what is not clear is can i use the same usb key(s) on my second mac mini ( both using apple memory -m2 on one and m4 on the other)?

Apparantly the ’ best ’ key is from yubi and also then can be used with near field access to iphone

before I buy two keys would appreciate comments

2

This article from Wirecutter has both a good overview of USB security keys and reviews of keys from various makers:

1 Like
3

But to use on my mini(s) it seems to require TWO USB keys to set up the appropriate passkey, etc

My understanding is that this is for redundancy in the event that a key is damaged or lost. There should be, in a truly secure system, no way to log into an account without a working key (or, at the very least, without a rigorous account reset procedure.) Unlike, say, passkeys in iCloud, or a password manager app, there is no way to just make a backup copy somewhere.

Having a backup key is the best way around this. Most accounts I’ve seen encourage, if not require, you to set up at least two keys for this reason. You’ll need both keys at hand to set up all of your accounts, then the other can be left in a secure place.

But what is not clear is can i use the same usb key(s) on my second mac mini ( both using apple memory -m2 on one and m4 on the other)?

Yes, you should be able to use the same keys on any device. I use the same two Yubikeys with my Macs (sticking them into the USB-C port and tapping when prompted) and with my iPhone (holding them up to the NFC receiver when prompted.) The credential can be read both ways.

4

THANK YOU!- thats what I suspected, but the descriptions I could find as to a requirement for two keys versus a suggestion for two keys was as clear as mud anmd depending on what year the
" method " to set up was posted. And the %&^%#$^ AI was worse than useless and I think I have now shut that pile of ^%*** off. Especially in apple mail. It seriously damages my luddite credentials
having used macs only since IIplus.