Apple Silicon users be aware if you configure the OS to require ONLY the smart card login (Yubikey) (so your password won't work anymore) then the last used smart card will be used for FileVault locking, meaning your drive will be encrypted by the smart card. So, if you loose you Yubikey it will mean trouble.
Hi Waldek! Thanks for watching and commenting. Glad you found the video helpful. I have several videos on how to use the Yubikey with different types of scenarios. Have a great day! Please subscribe.
Great job on this video. Comprehensive and concise. Much appreciated. This video could serve as a 'model' for other youtube creators to follow when creating compelling and useful content :-)
This is very interesting. I didn't realize the yubikey could be used in this manner. I thought you could only use them to generate OTP and a saved password. Very cool. Looking forward to full password less video next week.
can we do this on M1? I have an error - The pair has been created successfully, but the next time you log in with a SmartCard, you must enter a password to unlock the associated login. What to do with that please help.
Hi Tony, Thanks for the video. I'm not at all a techy person, and I think your videos are so helpful. I'm not sure if I have the wrong security key, but when I installed the manager, PIV is not an option for me as a Mac owner. I only have FIDO2. I don't even know what it means! Please help!
Hi Dean, thanks for watching. I don’t have an Apple Watch, so really can’t shed my light on this subject. I’m going to guess it will not. Have a great day.
Hi, thanks for watching. Honestly, If your skills are such that you are questioning yourself then I do not recommend doing this. I wouldn’t want to see you lock yourself out of your device. Have a great day.
Great video Tony. WOW, you are really on the security push, huh. Good for you 🙂 I'm afraid I've given up on that, even though most of my career was focused on computer/information/Cyber Security. The only thing I can say is that popular demand has broken me on the subject of security. I know this sounds very negative, however things are as bad as I can remember of the past 25-year - not that security has become more of a problem, but that people really don't want to hear about it. Once recent comment to one of my security focused video says it all - "Thinking about about security gives me a headache'. I'm not sure if I will ever make another one of those videos on my Channel. I do apologize for the negativity.
No need to apologize David. I had a viewer comment on Instagram that he did the Yubikey with Windows login, but the wife thought it was too complicated, so he removed it. I think a lot of it stems from folks not fully understanding the potential risks. It’s up to us techies to try to educate in this area to raise awareness. In any event, thanks for watching.
I think like tony said it's the attitude of "convenience is worth more than privacy and security." Those are the same people who might say "that bad thing could never happen in my town." It's a misguided ignorant view and you're right tony, there should be more education on the "what bad things can happen" so people take it seriously
4:10 if you still can use the user password, what's the idea of the yubikey password? not make sense! I expect the only way to login will be with the yubikey!
Hello John, I understand your position. I suppose if for some reason you don’t have your Yubikey with you or in the event it is lost, you still have access to your computer. I did a follow-up video locking it down to Yubikey only.
Thanks for watching. Yes, and yes but there is one caveat. There is a part 2 to this video that covers disabling password sign-in and only allows for sign-in with Yubikey. “DO NOT” attempt this on M1 Macs. It is not supported!
Can I use the same yubikey login to two macbooks I own? I think if i started by setting up for the 1st macbook, the slots in configuration will be taken by 1st one, then setting up the 2nd macbook would overwrite the slots? 🤔
Thanks for your response! It was enabled but the -f command paired it. However, when I try to use the yubikey in my Mac OS Lock Screen it says “PIN has invalid format” (and the input is much longer than the PIN I set for the yubikey)
Hi, please do not take this the wrong way, but this isn't how it is supposed to work. What is supposed to happen is, if the key is not inserted, it should not be possible to login even if the correct password or fingerprint is provided. The point is basically to prevent people who do not have physical access to your computer from being able to login remotely since they can't insert the yubikey. Do you know how to setup the yubikey to protect login in this way? Thanks.
Hi, thanks for watching! I appreciate the way you approached writing this comment. I totally understand your point. Here’s a second video: MacOS/Yubikey Login Part 2 - Lock Down MacOS Login To Yubikey Only ua-cam.com/video/UaTSsmsqZx0/v-deo.html Have a great day and thanks again for being supportive and not rude!
Hopefully, you have been diligent about backing up your MacBook. If I were in this situation, I would boot the MacBook in recovery mode, then restore from a Time Machine backup to a previous point in time.
For macOS login, you can't. The OS will require the last key you paired, so for now, it's impossible. I personally didn't set the profile to only use PIV to login. I destroyed my Yubikey, and the only way back in was the password and then I paired my backup while I had another key on order.
It’s not at all clear to me what the Management Key is or the PIN that was asked for is for-??? Please clarify: WHAT is the Management key you’re referring to? Where do I find it? What PIN are you referring to? How is it generated?
Hello, thanks for watching. The management key comes built-in. I don’t know what it is which is why I just used the Default Management Key. I also used the default PIN of 123456. That can be changed, using the program. But for the video, it was easiest to use the defaults. Have a great day.
Hello MAE, thanks for watching. I don’t have a video on this. However, to undo this, just go back into the Yubico Manager app and delete the two certificates that were created during the pairing process. Have a great day.
Thanks for watching! Actually, it’s the perfect use case for a one person home office where it’s just a matter of convenience not security. Much easier to touch the Yubikey rather than type in a password every time you want to login your computer?
Best and simplest explanation on UA-cam. Thank you.
Thanks Wayne. I appreciate that very much. Not sure it’s the best, I just like to keep things simple. Have a great night.
Apple Silicon users be aware if you configure the OS to require ONLY the smart card login (Yubikey) (so your password won't work anymore) then the last used smart card will be used for FileVault locking, meaning your drive will be encrypted by the smart card. So, if you loose you Yubikey it will mean trouble.
that make sense! because if the password still works, why use the yubikey!!!!! not make sense
Another great video, Tony. Am looking forward to your next part on MacOS with Yubikey
Thanks for watching DJ Ware! Much appreciated!
Hello buddy, you are perfect. You can explain difficult things in a simple way. I was given such a key as a gift. Now I know what to do with it. :)
Hi Waldek! Thanks for watching and commenting. Glad you found the video helpful. I have several videos on how to use the Yubikey with different types of scenarios. Have a great day! Please subscribe.
cheers Tony
Loved the video, Tony! As a new Mac user, I need to consider this!
Thanks For watching Frank. Glad you enjoyed the video and congratulations on becoming a new Mac user! Have a great day!
Great job on this video. Comprehensive and concise. Much appreciated. This video could serve as a 'model' for other youtube creators to follow when creating compelling and useful content :-)
Thank you very much for the awesome content. Glad you enjoyed the video.
Super excellent video Tony! I love your passwordless journey! Great job!
Thanks for watching Avi! Glad you’re enjoying the journey. Much appreciated.
Thanks for this video!
You’re welcome. Thanks for watching.
Thank you for sharing!
Thanks for watching!
This is very interesting. I didn't realize the yubikey could be used in this manner. I thought you could only use them to generate OTP and a saved password. Very cool. Looking forward to full password less video next week.
Thanks for watching Tech4Fun. I don’t believe I’ve seen you on the channel before. Glad you enjoyed the video.
Where is the link for next video on this topic?
@rky_com thanks for watching. Here you go… MacOS/Yubikey Login Part 2 - Lock Down MacOS Login To Yubikey Only
ua-cam.com/video/UaTSsmsqZx0/v-deo.html
create your backup key ???
can we do this on M1? I have an error - The pair has been created successfully, but the next time you log in with a SmartCard, you must enter a password to unlock the associated login. What to do with that please help.
Hi Tony,
Thanks for the video. I'm not at all a techy person, and I think your videos are so helpful. I'm not sure if I have the wrong security key, but when I installed the manager, PIV is not an option for me as a Mac owner. I only have FIDO2. I don't even know what it means! Please help!
What model Yubikey do you have?
@@QuikTechSolutions Thanks for your reply. I figured it out.
Great to hear! What was the issue?
@@noelpaintonsmith8091 What was the problem in the end and how did you solve it. Please tell me
Nice video!! But it works with macOS Apple Silicon? Thanks
Thanks for watching. Not recommended.
Great Video Tony. What happened if the password changes. Needs the pairing be done again or is this a onetime step?
Thanks for watching. That’s a great question and one I haven’t explored. The only way to find out is to try it. Have a great day.
i added in a pasword pin its said denied
Hi 👋 do you have to use the keychain ?
Can i usd two keys? One for back up?
Great video, very informative. If I add a Yubikey will that deactivate Apple Watch login? Cheers
Hi Dean, thanks for watching. I don’t have an Apple Watch, so really can’t shed my light on this subject. I’m going to guess it will not. Have a great day.
How can we use it for Mac network logins. MAC is joined to AD so how can we configure it for mobile accounts in MAC
I'm confused, is your video for developers or the laymen? I'm not finding it through apps? I'm on sonoma 😬
Hi, thanks for watching. Honestly, If your skills are such that you are questioning yourself then I do not recommend doing this. I wouldn’t want to see you lock yourself out of your device. Have a great day.
Great video Tony. WOW, you are really on the security push, huh. Good for you 🙂 I'm afraid I've given up on that, even though most of my career was focused on computer/information/Cyber Security. The only thing I can say is that popular demand has broken me on the subject of security. I know this sounds very negative, however things are as bad as I can remember of the past 25-year - not that security has become more of a problem, but that people really don't want to hear about it. Once recent comment to one of my security focused video says it all - "Thinking about about security gives me a headache'. I'm not sure if I will ever make another one of those videos on my Channel. I do apologize for the negativity.
No need to apologize David. I had a viewer comment on Instagram that he did the Yubikey with Windows login, but the wife thought it was too complicated, so he removed it. I think a lot of it stems from folks not fully understanding the potential risks. It’s up to us techies to try to educate in this area to raise awareness. In any event, thanks for watching.
I think like tony said it's the attitude of "convenience is worth more than privacy and security." Those are the same people who might say "that bad thing could never happen in my town." It's a misguided ignorant view and you're right tony, there should be more education on the "what bad things can happen" so people take it seriously
@@QuikTechSolutions You are right Tony. The true understanding of the risk is where the problem is rooted.
4:10 if you still can use the user password, what's the idea of the yubikey password? not make sense! I expect the only way to login will be with the yubikey!
I thought the same? Surely even with password you should need the yubikey? Doesn’t make sense to be honest
Hello John, I understand your position. I suppose if for some reason you don’t have your Yubikey with you or in the event it is lost, you still have access to your computer. I did a follow-up video locking it down to Yubikey only.
@@QuikTechSolutions Can you please make a video on how to setup a second yubikey as backup. while using Yubikey only.
thanks for this Video. But one question but is it possible to use this an my Mac and also on my mackbook air with 1 Yubikey?
Thanks for watching. Yes, and yes but there is one caveat. There is a part 2 to this video that covers disabling password sign-in and only allows for sign-in with Yubikey. “DO NOT” attempt this on M1 Macs. It is not supported!
Can I use the same yubikey login to two macbooks I own? I think if i started by setting up for the 1st macbook, the slots in configuration will be taken by 1st one, then setting up the 2nd macbook would overwrite the slots? 🤔
Thanks for watching. See the link to an article from Yubico. www.yubico.com/solutions/shared-workstations/
After I remove the Yubikey and re-insert it, I don't get a SmartCard pairing prompt. Any ideas?
Did you try the steps listed at the 2:44 mark of the video?
Thanks for your response! It was enabled but the -f command paired it. However, when I try to use the yubikey in my Mac OS Lock Screen it says “PIN has invalid format” (and the input is much longer than the PIN I set for the yubikey)
@alexbowe2316 try using the default pin (all zeros). I recall there being an issue with the Yubico Manager saving the user defined pin.
Hi, please do not take this the wrong way, but this isn't how it is supposed to work. What is supposed to happen is, if the key is not inserted, it should not be possible to login even if the correct password or fingerprint is provided. The point is basically to prevent people who do not have physical access to your computer from being able to login remotely since they can't insert the yubikey. Do you know how to setup the yubikey to protect login in this way? Thanks.
Hi, thanks for watching! I appreciate the way you approached writing this comment. I totally understand your point. Here’s a second video: MacOS/Yubikey Login Part 2 - Lock Down MacOS Login To Yubikey Only
ua-cam.com/video/UaTSsmsqZx0/v-deo.html
Have a great day and thanks again for being supportive and not rude!
Can I do this with OTP Authenticator codes in it or do I need a separate Yubico for this?… Can I use the same Yubico I have for my Codes?
Yes 👍🏻.
Help, I'm locked out of my macbook and when I connect my main yubikey and touch it and nothing, same with touch ID it doesn't work.
Hopefully, you have been diligent about backing up your MacBook. If I were in this situation, I would boot the MacBook in recovery mode, then restore from a Time Machine backup to a previous point in time.
how do i add a yubico key backup or second key?
For macOS login, you can't. The OS will require the last key you paired, so for now, it's impossible. I personally didn't set the profile to only use PIV to login. I destroyed my Yubikey, and the only way back in was the password and then I paired my backup while I had another key on order.
I would do this if I had a MAC. LOL
Haha! You can do this on Windows as well! Thanks for watching!
It’s not at all clear to me what the Management Key is or the PIN that was asked for is for-??? Please clarify: WHAT is the Management key you’re referring to? Where do I find it? What PIN are you referring to? How is it generated?
Hello, thanks for watching. The management key comes built-in. I don’t know what it is which is why I just used the Default Management Key. I also used the default PIN of 123456. That can be changed, using the program. But for the video, it was easiest to use the defaults. Have a great day.
It'd be good to have a video that actually shows how to disable it instead
Any links to videos would be great
Hello MAE, thanks for watching. I don’t have a video on this. However, to undo this, just go back into the Yubico Manager app and delete the two certificates that were created during the pairing process. Have a great day.
@@QuikTechSolutions Thank you.! Yes, I have done exatly that.
Awesome! 👏🏻
The only way this is secure is if you enable require smart card, otherwise it is pointless.
Thanks for watching! Actually, it’s the perfect use case for a one person home office where it’s just a matter of convenience not security. Much easier to touch the Yubikey rather than type in a password every time you want to login your computer?