Strange Use Questions About Yubikey Set-Up

https://xkcd.com/538

There are a lot of ways to use a Yubikey. But I will address your thoughts as I can.

If I set up a Yubikey on a Windows 10/11 system, can I still access the system with a password if I lose the key?

First, the API Yubico used to support this functionality was completely removed in Windows 11 (unless you are using Azure AD). I suggest finding other ways to secure your laptop. This would include Bitlocker for at-rest encryption and other forms of authentication for the login. For instance, some laptops have a fingerprint reader? But you speak later of disaster recovery options when you are away from home, so I would probably recommend a passphrase

If I'm incapacitated or killed, I'd like my tech-ignorant partner/family easily gain access to my stuff so they can close my accounts, devices and archives.

So good you are thinking about this. You need to leave some records for your executor or a tech savvy friend of your executor to disassemble all of this.

What I am going to lead you toward is to secure a Bitwarden password vault with your Yubikey (and a strong master password) and then, to address this last point, create and save offline backups of the vault--including your master password, 2FA recovery code, and even spare Yubikeys registered with Bitwarden and your ema provider. This last part is not strictly necessary, but it can give you peace of mind.

if I'm arrested or detained by some authority figure, I'd like to make sure they can't force me to unlock something.

Stay away from biometrics! Forcibly obtaining your fingerprint, FaceId, etc. is NOT a violation of the US Fourth Amendment. Conversely, you are not required to ever give up a password.

If you secure your Bitwarden and primary email accounts with good passphrases and your Yubikey, your threat surfaces become the mobile devices themselves. There are good ways to protect those computers, depending on your exact configuration. Separate discussions.

Will the NFC tap unlock the phone, or will I still need a biometeric/password to unlock the phone?

Per my earlier discussion, you should still require a password or longer PIN to unlock your phone. Stay away from biometrics.

OTOH you can and should add security around the Bitwarden installation on your phone. You can tune how long the vault stays open, and you can even set it to completely log out after the timeout, which would require using the master password AND the Yubikey to get back in. That's a little drastic for most of us, but it's an option, especially if you are away from home.

I'd like to keep this on me at all times,

Lots of solutions to this. I keep my Yubikey 5 on its own keyring, which in turn is on a locking caribiner that has my other keys. I still worry about it banging around, so I got this cover for it. I have been very happy with it.

two-pack of the cheaper, blue Security Keys, of the black Yubikey 5?

You can get away with just one Yubikey 5 NFC. I think you will find the NFC functionality useful. However, you need a good disaster recovery plan if the token is lost or broken.

I mentioned password manager backups earlier. You should create backups of your vault and store them in multiple locations. (In case of a house fire you don't want a single event to destroy your only backup or your Yubikey and your only backup.) It is better if you have multiple copies of the backup at each site: single point of failure, again.

I recommend using physical security such as a safe or safe deposit box. I discourage online cloud storage or encryption here. These are additional barriers for your executor, and the additional passwords or encryption keys lead back to the need for a secure location anyway, so you haven't really gained anything.

With the Yubikey plus Bitwarden setup, you have a multi layer security system, where the device holding your Bitwarden installation is secured, and then Bitwarden itself is secured via both a password and a Yubikey.

I hope you can start with my ideas and tweak them to fit your risk profile. Everyone has different needs, and perhaps you can adapt all of this to work for you.

[deleted]

YUBICO key 🔑 on windows 10 - I gave up . Forget about it . Maybe there is light at the end of the tunnel with windows 11 🤷🏻‍♂️