Enabling multifactor authentication is the single best thing you can do to prevent attackers from taking over your online accounts. Hardware multifactor keys like the Yubico YubiKey 5C NFC provide all the security of competing systems, but they do so without moving parts, batteries, or an internet connection. The 5C NFC also has a variety of authentication capabilities and will work with just about any recent device you own. At $55 it’s not the cheapest option, but its sheer versatility makes it a new Editors’ Choice winner.
What Is Multifactor Authentication?
The term “multifactor authentication” comes from the idea that there are three ways to prove who you are by presenting at least one of the following: Something you know, something you have, or something you are.
Most of us use password authentication in our day-to-day lives, which is something you know. Something you are could include biometrics, like a fingerprint scan. A hardware authenticator like a Yubico YubiKey is something you have. Using at least two of these means you’re using multifactor authentication. Two-factor authentication, sometimes abbreviated as 2FA, is the most common form of multifactor authentication you’re likely to encounter. As you might guess, 2FA requires you to use two factors in order to get access to whatever it’s protecting.
The advantage of multifactor authentication is that it’s much harder for an attacker to have access to multiple factors at the same time. A bad guy trying to take over your account can easily download stolen login credentials, but it’s much harder for that same bad guy to also steal your fingerprint or your YubiKey or your mobile device. The numbers bear this out, too. When Google started requiring employees to use hardware multifactor keys, account takeovers effectively dropped to zero. Recently, Twitter declared, “While any form of 2FA is better than no 2FA, physical security keys are the most effective.”
Turn the Key
The YubiKey 5C NFC is one of several devices in the YubiKey 5 series. The only difference between the 5 series keys is how they communicate with your devices. The 5Ci, for instance, has Apple Lightning and USB-C connectors. The 5 NFC has a USB-A connector and can communicate wirelessly via NFC. The 5C NFC, reviewed here, has a USB-C connector and NFC capabilities.
When I last reviewed a hardware multifactor key, USB-A was still king, but my fellow PCMag analysts tell me USB-C is now widely available. In fact, the Apple computer I’m using to write this review has precisely zero USB-A ports, but two USB-C ports. With USB-C on many recent computers and mobile devices, and the almost-universal availability of NFC, the 5C NFC is capable of communicating with just about any device, regardless of brand, making it the most versatile hardware multifactor key I’ve yet reviewed.
Pricing of the 5 series varies. The double-headed 5Ci costs $70 and the 5 NFC just $45. Notably, the $50 5 Nano and the $60 5C Nano are designed to sit semi-permanently within USB-A or -C ports. At $55, the 5C falls between the other two, still putting it at the high end. The Google Titan Security Key bundle offers a wireless fob and a USB-A NFC key for $50 or a single USB-C key without NFC for $40, and the NitroKey FIDO2 costs just €29 but doesn’t support USB-C or NFC. While the 5C costs more than these, it also offers more.
Like most of its 5-series cousins, the YubiKey 5C NFC is made of sturdy black plastic with a textured finish. It’s small—a little shorter than a house key and about the same thickness. A metal-reinforced opening means it can survive years on a keychain. I like this much better than the clunkier design of the Nitrokey FIDO2.
With no batteries and no moving parts, the YubiKey 5C NFC is durable and water-resistant. Its single interface is a gold disk emblazoned with a “Y” that glows green when connected via USB-C. A wireless communication symbol differentiates it from YubiKeys that lack NFC. The disk is capacitive and will respond to your tap, but it is not a fingerprint reader. The 5C NFC can do a lot of things, but biometrics isn’t one of them.
Supply-chain security is a long-running concern for Yubico, which boasts that its devices are manufactured in either the US or Sweden. The implication is that it’s not made in China, which either may be a smart move for security or little more than marketing, depending on who you talk to. As a security precaution, YubiKey firmware is not upgradable. This protects against attack, but it also means that anyone interested in hacking YubiKey to add custom capabilities will likely be stymied.
Hands-On With the Yubico YubiKey 5C NFC
The main use for any hardware security key is as a second-factor authenticator. In this scenario, you enter your username and password and are then prompted to plug in and tap your key. The YubiKey 5C NFC supports a number of standards for this: WebAuthn, Fido1 or 2, CTAP2, or Universal 2nd Factor (U2F). I’ve yet to see a site or service that supports hardware keys that didn’t work with a YubiKey. The cheaper Yubico Security Key NFC and most competitors only support this tap-to-authenticate form of 2FA.
I tested this feature using Twitter, which supports multifactor hardware keys. Enrollment was simple: Just navigate to the appropriate Settings panel, insert the key into a USB-C port, and tap the key when prompted. The experience is the same for most sites and services, though some will let you enroll multiple keys as a backup. I then logged out and logged back into Twitter, entering my username and password. The site prompted me to insert and tap my key. Doing so granted me access to the account. I also successfully logged in on an Android device, once by connecting the 5C NFC to the USB-C port on my Pixel 3a and once via NFC. I successfully used the 5C NFC with both the Twitter mobile site and the Twitter Android app.
I did encounter a few caveats in my testing. I had no trouble using the YubiKey 5C NFC with the Firefox browser on my MacBook Pro, but the Android version of the browser did not recognize the key. Because of my settings, Android used Firefox to display the login screen inside the Twitter app (Google’s Chrome for Android is the default), and didn’t recognize the key in that context, either. Nor did it recognize the NFC communication with Firefox. Once I changed my default browser to Chrome, though, it was smooth sailing.
One minor quibble is that it’s often hard to find the sweet spot on a mobile device that will read the YubiKey. This is a long-standing issue I have with NFC and mobile devices, where I have to rub and tap the key all over the phone’s reverse side until something happens. I can’t blame the YubiKey for this; rather, it’s a reminder that NFC is still a bit finicky. The Google Titan Security Key bundle includes a battery-powered Bluetooth authenticator fob, in addition to a USB-A NFC security key. Bluetooth is definitely more reliable than NFC, but it also requires batteries.
YubiKeys can also completely replace password logins in some contexts. Only a few sites and services support password-less login, but I was able to test this feature with my Microsoft account. I still needed a username and password to create the account, but when I enrolled the YubiKey 5C NFC, I was prompted to tap the key and enter a PIN on the keyboard. The next time I went to login to my account, I didn’t have to enter my username or password. I just clicked the security key option, inserted the 5C NFC when prompted, tapped, entered my PIN, and I was in. This was only available with the Edge browser on a Windows 10 computer, but it was a convincing vision of a life without passwords.
Unfortunately, support for hardware multifactor devices, regardless of type, is still limited. Big names like Facebook, Google, and Twitter all have security key options, but it’s far more likely for a site to support a different multifactor option. Most financial institutions still stubbornly cling to SMS 2FA, for example. Yubico maintains a running list of the sites and services that support its devices, but it’s more complex than it looks. A site might be listed even though it hasn’t fully rolled out support, only supports YubiKeys for enterprise customers, or supports aspect of the YubiKey’s abilities but not the core tap-to-authenticate feature.
Beyond the Key
The “key” selling point of the YubiKey 5 series is the range of authentication actions these devices can perform. For example: Yubico has deployed an ingenious way to integrate YubiKey 4 and 5 series devices with a one-time-code-generating authenticator app. You can use this with any site that supports Google Authenticator (specifically, OATH–TOTP) to generate one-time use passcodes every 30 seconds. Instead of storing the information to generate these codes on your phone, the Yubico Authenticator app stores the data in the YubiKey’s secure element.
While testing the YubiKey 5C NFC, I used the YubiKey Authenticator app on macOS to activate 2FA for Twitter. This was simple: When Twitter prompted me to scan a QR code, I clicked a button in the app and the information was captured from my screen. With the 5C NFC plugged in, the YubiKey authenticator app could generate the one-time use codes necessary for logging into Twitter. Removing the YubiKey causes the TOTP codes to vanish from the screen. I was able to retrieve and successfully use a TOTP using the Yubico Authenticator app on Android, too. Conveniently, you can connect to your mobile device via USB-C or simply tap to transfer the information via NFC. The YubiKey Authenticator app occasionally prompts you to tap your key to view the TOTP codes, for an extra layer of protection.
The added security of using your YubiKey for TOTPs does come at a cost. Supported YubiKeys can only store TOTP data for 32 sites. That might be enough for the average consumer, but I have 42 sites stored in my authenticator app. You also cannot back up the TOTP data stored on the YubiKey. The LastPass Authenticator automatically backs up your TOTP data. Instead, Yubico suggests that you save the QR code (or text code) used to generate the TOTP for use with another YubiKey. It’s a very cool feature, but also one with a lot of friction and I have a hard time imagining most people would tolerate these limitations.
You can also configure a YubiKey 5 key to work as a PIV-compatible smart card, generate or store one-time passcodes (the YubiKey 5C NFC supports Yubico OTP, OATH-HOTP, and TOTP), or simply have it spit out a static password on command. The YubiKey 5 series works with OpenPGP, too, though actually using PGP is an involved process. The key has a few even more esoteric tricks up its sleeve, too.
This laundry list of options is configured with the YubiKey Manager desktop app, which also lets you disable features. You could, for example, disable the YubiKey 5C NFC’s titular NFC capabilities if you’re concerned about the security of wireless communications. If you’re the curious, tinkering type, the versatility of the YubiKey 5 series makes it an irresistible choice. If not, you’re better served by the Yubico Security Key NFC. The device costs half as much ($24.50) but supports only the tap-to-authenticate feature (which is what most people will use it for anyway) and only communicates via a USB-A connector or NFC.
Security in a Major Key
Yubico’s YubiKey 5C NFC does just about everything that you could possibly want a multifactor key to do. It has a lengthy list of capabilities, but it also supports the simple tap-to-authenticate system and does so without a steep learning curve. The 5C NFC’s ability to store TOTP data is handy, but perhaps too limited. It’s nearly indestructible, and everywhere it works, it works perfectly. The best features of the YubiKey 5C NFC are its eponymous USB-C connector and NFC capabilities, which lets it communicate with just about any combination of devices you may have.
My biggest complaint about the YubiKey 5C NFC isn’t anything to do with the key itself, but with the slow and slipshod adoption of multifactor authentication and hardware keys in particular. There is no way for you, the end-user, to pick your preferred method and use it everywhere. Even after buying a YubiKey you’ll undoubtedly still have sites that require an authenticator app or, God help you, SMS codes. This friction is far more likely to confuse and frustrate everyday users than any quirk of any security key.
The YubiKey 5C NFC continues Yubico’s track record of excellence in the field of hardware multifactor authentication keys. With NFC and USB-C now widespread, it’s our newest Editors’ Choice for hardware multifactor keys. If, however, you’re more overwhelmed than thrilled by everything the 5C NFC can do, there are numerous affordable alternatives. While we have not tested them, the Google Titan Security Key USB-C appears to be a solid USB-C option. If USB-A is more your style, the $25 Yubico Security Key NFC looks to be a worthy update on an excellent product.
