YubiKey NEO NFC Security Key

I absolutely love the NEO. In fact I started out with their lowest end model, upgraded to this and then moved up to a Nano. Not b/c this wasn't good enough but just b/c I got hooked on them and the Nano has a big form factor difference. Here's the deal. If you use PasswordSafe or some other well known tool that is Yubikey friendly, you'll love this thing. If you want to use it for OAUTH or using really long safe passwords, it's quite well suited to that took. I use ridiculous passwords and change them frequently and that's why these are so 'must have' or me. Fair warning though - installation and use are going to probably be a real challenge for the uninitiated. I can almost guarantee that. There is plenty of support material for it from Yubico, there are plenty of people blogging about it and there are plenty of videos, but until you understand what you're doing it's going to be tough at first. IMHO, it's well worth the hassle of learning and the learning process is tremendously valuable in and of itself. However, that's where I can't emphasize a point strongly enough. MAKE BACKUPS. It's very easy to change the configuration in a way that you end up locking yourself out of important apps you have precisely b/c it does its job so well. It's a feature that can behave like a bug as the expression says but it's easily remedied by just using backups every time before making a change. Buy two of them if you get one just so you have a backup, you don't want to be stuck if you lose it and have to wait for another one to arrive. And make really sure that you understand the basics objectives of what it's intended to do. Products that are friendly to it are being added regularly and as useful and just plain awesome as these things are, I'm sure that will grow. However the initial configuration coupled with learning what you're doing is enough to make many people want to throw up their hands and rage quit. I certainly felt like that at first. The learning process alone justifies the cost of buying one. Plan on spending at least two hours minimum learning what it does and how to configure it and realistically, if you want to really 'trick it out' plan on spending quite a bit more time. That said, if you even remotely care about security, every second of that learning time will be useful. Not just because it will help you learn to use the tool, but by seeing that certain features are even available you'll learn a lot about good security practice and you'll probably end up changing the way you do things to become more security focused. These aren't cheap and Yubico has lower priced models that accomplish much of the same but within 3 days of getting my first one, I wanted to upgrade and then I want for a Nano as well. I love this so much that I actually purchased several for friends of mine, employees and peers that care about security just because I want to see these take off. I don't want to scare you off about the initial configuration but the best way to say it is that some not everything is plug and play. Like most things of real value, you're not going to be able to just run a wizard and be an expert at it. In this case, you'll likely spend a little while frustrated at first getting it to work with whatever the first feature is you decide to use it for. From there you'll almost certainly find yourself in a position of wanting to 'see what else I can do with it' which is where the backups become critical. And like I said, if you only have one, you're vulnerable to being stuck if you lose it so redundancy is your friend here. I've purchased around 20 different keys and all three models and I'll be buying more. I am so smitten with it that I find myself looking to try to convince people who aren't security conscious of how vulnerable they make themselves and convincing them to change their behavior.. Because of my enthusiasm and people seeing what it does for me (for instance, if I look at DropBox or Facebook from my phone people see me putting it up to my phone and asking what I'm doing), I've convinced a few people to adopt them. The others were already looking to try them but hearing my excitement was enough to get them to adopt it. These aren't that cheap that I'd typically go around and indiscriminately buy them for people just to get them to try it but that's what it's done. And so far, I've had two people say "not interested', another 2 give up in frustration and the rest have become as fanatical about them as I am. Also, you can use the app that Google provides for Gmail and its other services but there's a risk of introducing a vulenerability by using that. Like anything security related, you trade convenience for security. I wasn't overly worried about someone pulling off the attack before when I was using Google's app but it's still there depending on how important the stuff you want to protect is. Nonetheless, so many other services now support Yubikeys, PasswordSafe being the initial impetus for trying it (I have no connection to this company or Password safe, but Bruce Schneier turned me on to PasswordSafe and I definitely trust his judgment on anything security related. If you are security focused you'll know who he is, if you're not, I'd encourage you to check out his blog and follow his advice. In that regard, think about it this way. Is there anything in your email or dropbox or facebook that you wouldn't want the world knowing? Note how many popular YouTubers for instance have had their accounts hacked and commandeered recently. None of them woke up that morning thinking "I'm about to lose control of my stuff". And once your information is taken from you, there's not putting that genie back in the bottle. You 'leak' more information than you can possibly fathom these days and even if you password protect your phone, losing it means the only thing protecting your personal information and secrets from the world seeing them is some malicious person using a Cellebrite machine or similar tool to get through your password. You may think I'm being dramatic but if you think I'm exaggerating in the least (i'm actually not doing the threat justice) go look around at Cellebrite's UFED or similar tools and see how 30 seconds is the only speedbump someone would hit if they had access to your phone and the desire to get your info.