I have used them and they can give good security but most everyone these days uses phone apps. From an organizational perspective you might use tokens to make it harder for your staff to exfiltrate keys by rooting their phones. For an individual, carrying a FIDO token is potentially more convenient and private than carrying a phone, but the ease of pressing a button vs typing 6 digits isn't that big a deal unless you do it constantly.

I guess there is another virtue, if you're using the phone itself as a login device, with a password manager accessible from the phone. In that case, a 2fa app on the same phone is no longer truly a second factor. A token fixes that. I have a to-do item of setting up my phone to use a token to unlock the TOTP app. So that wouldn't eliminate typing 6 digits. It would just make the TOTP app use real 2FA.

I bought 2 yubikeys. I try to use it for as many accounts as I can but I can only think of a handful who allow yubikeys. I would get them if you want to but a good 2fa should work fine. Most banks and actual important stuff barely have totp 2fa anyways.

I just ordered couple of yubikeys to play around with. Mainly because my phone died and couldn't get into Gmail to get my bit warden two factor email without my phone to approve the Gmail login.... Luckily phone came back online but was a bit scary to think how tied I was to my phone being operational.

Mostly yubikey users in here so shout out to fully open source SoloKeys.

I use a YubiKey and I like it. At this point the bulk of my 2FA is in ProtonPass, but for my work Microsoft 365 and Duo specifically it's nice to default to it and I'm more likely to have it since it's on my key ring, than my phone. Also nice to have stuff pointed to that rather than an app if you like to upgrade or wipe your phone frequently.

I think most businesses that don't provide work phones should be getting them for their employees so they don't need to require that employee install an app on their personal device.

In my opinion the biggest problem with hardware keys is what happens when you lose them. You have to either provision the keys yourself, putting the secret on your computer. Or you have to buy backup keys and make sure to register both with all your services. You’ll end up using your phone or password manager as a “backup.” And then that backup becomes your primary 2FA.

I have not used hardware keys, but if I were going to, I would want one that is open source hardware and software like the solo key.

Yes, but its not supported on everything. I use Yubikeys since they support more interaction types. I personally use them to lock my more important things when I can. Like my password vault, financial sites, emails, accounts, etc.

For the accounts that are whatever, less important I use OTP. You can also store a limited amount of OTP tokens on the Yubikey and use their open source software to view the codes.

ALWAYS buy a backup if you do end up locking accounts with it, just in case you lose it. It is more secure than having a code saved digitally as you need the physical key to unlock things.

This is not quite the same product but I thought this device looked interesting

https://tillitis.se/

I recommend NitroKeys. They are very secure and open-source.

Last year Cloudflare had some offers to buy Yubikeys at half price. Bought two of them. Using these hardware keys is better than trusting phone to be single failure and getting locked out.

https://onlykey.io/

Built in hardware pin entry means your unlock code can't be captured by a compromised machine. Emulates Yubikey if you need that, handles Fido / U2F, stores up to 12 passwords, acts as PGP and SSH key if you install the (open source) agent.

The SSH agent implementation is forked from https://trezor.io/ which is advertised more for crypyo wallet uses.

Edit: For OP's concern about losing the key, it also has the ability to export an encrypted backup that can be restored to a replacement key

I want to add that you can not only use USB keys as second factors, but also as a password replacement on Linux and Windows. It is extremely convenient to press a button instead of typing a 16 character pw.

I'm not an expert but the way I see it is this: if you're tech-savvy and use common sense, they're not necessary, as a 2FA app with TOTP along with random, strong passwords should be enough. I still use both for most things, only securing more sensitive stuff with a physical key.

However, having one definitely can't hurt, and if you're passionate about cybersec, it'd be kinda strange if you didn't have one.

Yubikey bio has a fingerprint reader built into it. Which is very nice. Even if the device you're using is compromised you will never expose your pin.

The only key also has that advantage.

Safer to use QubesOS and run keepass in a vault VM

im preferential of the concept of just using a USB drive, and some basic scripting automation to trigger it.

Thats just me hating anything moderately proprietary though.