iOS 16.3 Hardware Security Keys explained - Should you use them?
An explainer of iOS 16.3 Hardware Security Keys support. Should you consider using them? Which hardware security keys should you buy? Watch this first!
Featured in this video:
Feitian ePass: amzn.to/3JcUfvY
Yubico Security Key C: amzn.to/3WnDv8x
Yubikey 5: amzn.to/3ksOfVH
FTC: We use income earning auto affiliate links:
9to5mac.com/about/#affiliatem...
Written post: 9to5mac.com/2023/02/03/ios-16...
Subscribe: 🔔 kzhead.info?sub...
Comment: 📝 Let me know what you think...
Follow: ✅ / jeffbenjam | / jeffbenjam
CHAPTERS:
0:00 Introduction
0:24 Security Keys replaces 6-digit codes
1:35 Requirements for using hardware security keys
2:40 Compatible keys
6:13 How to add security keys
10:53 Removing and adding additional keys
12:24 How to authenticate with security keys
16:28 Devices running older firmware
18:39 Disable keys and fall back on 6-digit codes
19:50 Setting up new devices running older firmware
21:29 Setting up new devices running iOS 16.3 or later
22:00 My take
FOLLOW
- / 9to5mac
- / 9to5mac
CREDITS
- Final Cut Pro Plugins by MotionVFX: bit.ly/3H6Ck6u
- Music by Soundstripe: bit.ly/3G4wd16
- Captions by Rev: bit.ly/3fYySz1
TAGS
#iOS #security #iphone
Thanks so much for this breakdown. 😊😊
Great video as always man. Another in depth master class in ios/tech. These are the deepdives that 9to5Mac needed. So glad you're back.
Super good detail instruction. Thanks a lot
Thank you for the video, This is a vary good explanation! Question do you know if you can use the same 2 securities keys for 2 different apple accounts? example my wife and I have 2 different accounts. Can we use the same keys?
Very comprehensive overview! Thx you!
Good stuff Jeff 👍🏻👍🏻👍🏻🤘🏻
Very helpful and very detailed. Nice job, Thanks for sharing.
Excellent comprehensive video!
Thanks, that was very informative. What about LGTV - you have one in your list of devices. Would it be out of the "team" the same as "icloud for Windows"?
So nice to hear your voice Jeff!
Hey Jeff, this video is awesome! Thank you so much for making such a clear and well done video to explain this detailed process! Best explanation I have seen. Thank you.
Great video!
Awesome. My respects.
Awesome video!! Does this address Passcode gate issue?
Great video! Thanks for all your trouble of testing different scenarios. Getting my two Yubi keys tomorrow and setting this up. Im reconning I put one Yubi key witch Usb-C on my keychain which has a AirTag on it and put one I the same fault I put met secret key for iCloud advanced data protection.
Sounds like you have a plan.
Love the HDR options
Really well done video Jeff. Very comprehensive and clear. Thank you.
Thanks for watching Mikel.
Great video, very detailed . Thanks much.
Thanks for watching Wayne, I hope you come back and visit.
Hello, thank you for the video, I read that children accounts are not managed by Yubikeys. But, I guess that you cans till mange them, it's just that they are not protected by the Yubikey as 2FA right ? thank you
Let me know if you guys and gals have any specific questions that you'd like answered. - Jeff
Hey man at 2:18 your showing your trusted phone number in the menu settings.
Do these keys have a battery that can deplete or they can theoretically last a lifetime ?
What about an Apple ID password reset? Is the hardware key needed for that.
@@win183672 no battery. yubico estimates the life expectancy of their keys to 30+ years.
@@andrewgrant788 see "Use a security key to reset your Apple ID password"
Great video, at 2:27 though you seem to have your phone number unburied if that matters to you, just a heads up!
4K HDR video, nice!!
When I go thru the 2 keys registration on my iPhone, I get "Security keys not supported." for my MacBookPro11,1 listed in the active devices. Of course I can't upgrade to Ventura (with OpenCore), so what will happen if I complete the 2 keys registration? --> I won't be able to use my AppleID on that Mac?
Will the keys make it harder for someone to change your Apple ID password if the figured out your phone passcode?
Jeff has the best content without fluff. He is very thorough and for me, understandable.👏
Will ask for my security key when I try to change the AppleID password inside of settings, instead of asking for my pass code?
I heard that there is an issue with Apple silicon computers where only the last used yubikey can decrypt the filevault. That makes the having more than one key worthless.
Can u have keys and 2fa phone numbers at the same time
Finally a person that shows how to actually use the keys. I had to click through maybe 20 videos and all they showed how to add keys not how to use them you are the only one that actually showed how to use them.
How can I use the keys if I lose my Iphone ??
Great video. If you are away from home and don’t have one of the keys with you and you need to use two factor authorization. Do you just remove the security keys from the system using your iPhone then use two factor authorization and then put the keys back on the iphone system when you return home?
From what I understand from this video is that you need a third key to remove the keys so, presumably if you loose your phone no one can get into your iCloud account without the third key, I think!
Nice! Thanks for sharing.
Thank you for the thoroughly detailed look at Security Keys and all the different scenarios they can be used in.
So you can remove keys without need the keys? just the phone code???😢😮
2:35 wut apple still lets you use a four-digit passcode and how do you do that eight is supported too
When you added the blue key to your iphone using NFC - do you also have to add it to a Mac with the USB-C port or does adding via one method also validate it for use on your account via the USB-C connection ?
The connection method doesn't matter.
The key is tied to your icloud account. So it's for everywhere you're using that account.
Great explanation man, I really wanna get a set of the YubiKey security keys for my accounts! 😄
Be careful. It’s not all unicorns and rainbows.
@@majorgear1021 seems like it is to me. :) but jokes aside, I’m usually as careful as can be with this sort of stuff lol. My cousin who is a software engineer also gave me a few tips and uses them as well. Thanks for the concern though!
Question, can I use a set of security keys for 2 different appleID’s (mine and my wife’s)? It would simplify (and reduce the cost considerably).
yes
Thank you very much Jeff
I have found that the Google Titan Keys work too. I wish iPads had NFC but at least they are usb-c now.
Yeah, I wish all devices had NFC. It's so much more convenient using keys that way.
I have a new iPhone 14 pro max but an older 2011 MacBook Pro, what will happen if I’m locked out of my MacBook Pro by this key? Lots to unpack in this video.
Great explanation, most videos show how to set them up but don’t explain exactly what they do.
Why the feitan epass doesn't work on Samsung phones?
Is it possible to use these keys only as a 2FA for passwords only and not to log into iPhones? I’d like to be able to continue to use my 6 character password to log into my locked iPhone, but still use a key to use as 2FA to log into apps such as banks, credit cards, etc. using LastPass? Thanks!
1. These keys are not used to log into iphones, they're used when logging in with your icloud account. 2. You can still use your passcode. 3. Your Lastpass account and Icloud account are separate accounts.
Thank god your back! And the beautiful HDR videos. Love it
Hello. You mentioned that Yubikey would not work with PC iCloud; then how would I access their iCloud from Windows 10 PC?
You can't. You don't use physical keys if you need to access iCloud on Windows. Sorry.
You stated when you enable FIDO2 first and then UBF they key is recognised as two separate keys at 5:35 Does that mean that you could use it as "two" security keys to bypass the Apple minimum requirement?
maybe, but probably not. either way, you need 2 keys, in case of losing 1 key.
even if it would work, it wouldn't be a good choice. You need to have backup keys.
@@senchaholic I'm aware but if I'm thinking of doing this; I don't particularly care about that.
So.. few weeks ago I saw that documentary (or what you want to call it) about how ppl look other ppl over the shoulder to see them putting in their pin before they steal the iPhone and change AppleID Password and Stuff. I thought those Security Keys could help, but if you know the pin, you can just remove them? :O
can you remove the keys while logged in but without having the key with you?
nevermind ... answer was in the video
I have a question, When I'm ready to trade in my 13 pro max for the new 15, do I need to remove the security keys from my old phone?
When you trade in your phone, just factory reset it. That's all you have to do.
The key is tied to your icloud account, not your device.
Is this video HDR? It’s way brighter than the other parts of the screen.
Yes
Exceptional vid. Very comprehensive & clarity is superb. Thank you.
How rugged are these keys? And, do you recommend having a back up key?
Apple requires that you enroll two separate keys so you have a backup key. If you lose both keys, you will need a new Apple ID.
The yubikeys are very rugged. But backups are still essential.
can I only use a security key for the apple id account? or also for other "websites" like ebay or a bank account? if so how do i do that?
You can use the security key for all accounts that support it. Big ones are Ebay, Amazon, Microsoft, Google, Twitter, etc. Banks don't support them, because banks are big fans of insecure ancient technology like SMS 2FA.
@@estusflask982 I was reading a lot the past days and looks like that Passkeys are the next big thingy? They are just stored on your phone, like in the password app and are used to identify your several accounts
@@kumamonkumamoto3844 Passkeys are essentially the soft equivalent of a hardware key. Note that a passkey, in contrast to a hardware key, is tied to whatever system you create it on and can't easily, if it's even possible, be migrated. Check this first.
So what if i lose or someone stole my iphone and everything is logged in my iphone and have very sensetive information like passwords, Credit Card details and other important documents are in the iPhone. Can they open my iphone with just password or do they need this security key to get into my phone to access my sensitive information?
You could sign out of that device, from another ?
@@everyhandletaken what if that person changed my login password and everything and logged me off of everything before i could do anything? Then will this security key be of any use?
@@amangeorge2407 good question. If they knew the passcode to unlock & you didn’t have a security key, then they could. I can’t test it, but I don’t think it would be different with the security key. To me, I think it should be required to present the security key when viewing your Apple ID details on the device, but that doesn’t seem to be the case.
Just added security keys to my iPhone. I changed my Apple ID but was not prompted for security key ? I was expecting a request security key so my Apple ID could not be changed in the event of iphone was stolen. Also it seems security keys can be removed without any security key verification beforehand.
They would have to get past your lockscreen first..
Can you also secure two AppleIDs with a pair of keys or does my wife need a second pair of keys?
there are no limits to how many accounts you use a key with
@@senchaholic Thank you.
I recently bought a Yubikey 5 Nano and a 5Ci. I can register the 5Ci as a security key with my iPhone SE2, but not the Nano. These products are too difficult. I wasted $135.
Excellent lay down Jeff! So glad you’re back. You just brushed on the topic but you can use the Yubico key in place of a login on a Mac. Perhaps a video on that…hint…hint.
Can you clone that cleave that key with the flipper zero?
Nope. Already tried…
@@RandomBogey Good to know...
@@9to5Mac That’s not to say there isn’t a more advanced method of cloning, that just exceeds my knowledge of NFC/the Flipper, that could potentially be used with the Flipper hardware to clone a key. But, as far as some rando with a Flipper (running the stock Flipper firmware) being able to clone your NFC security key, then use it to log in to one of your accounts, I don’t think it’s possible…
@@RandomBogey Yubico has covered this in one of their support articles.
How do we know if these keys aren’t compromised. Is there a specific standard for these keys.
Such as cloned? I don't think there's really any way to verify that. But I may have misinterpreted your question. If any smarter security folks here that can chime in, please have at it.
@@9to5Mac your interpretation is spot on. I’m taking the wait and see approach.
@@cliftonparchment4498 According to Random Bogey, you can't clone it with the flipperzero, so there's that.
As far as I know there are open source keys so that everyone can check for security vulnerabilities. Also, cloning those keys should be impossible because they‘re using a challenge-response method so the „secret“ never leaves the key.
The way they work is that they're like your keys. They need physical access to it.
Set up an ubico key with PIV, which worked like a charm, but couldn't get two keys working. Restrictions with processors. So, I removed the key. Used the MAC for two weeks without a problem going back to password only, no key. Removed all the apps and key only profile. Then one day it asked me for the pin, pin only. I had to wipe the OS. This is why MACs are good for entertainment purposes only.
Excellent video BUT I’m a little confused. My wife has an iPad that uses my Apple ID. I have an iPhone, iPad M2 and a MacBook Air with M2. I’d like to set up use the hardware keys for MY devices but NOT on my wife’s iPad. Can I do that or am I prevented from doing that because we use my Apple ID for her iPad?
Hardware keys are at the Apple ID level, not device level. So if you enable keys for Apple ID, any device that uses that Apple ID is affected. That said, once the device is authenticated, you shouldn’t regularly need key access for most things.
Security keys are associated with an AppleID account. If your wife is using your device (even if she’s just borrowing it), then she will eventually be prompted for your key at some point, depending on what she’s doing. If you play fast and loose with your security by letting other people use your equipment, you are opening yourself up to security risks anyway. Get her her own security keys to use with her own account. Account sharing is an awful, terrible idea. Even if you can get it to work, it’s confusing and introduces a uncertainty into the set up. Security and uncertainty do not go together.
I think this video is for modern Imacs cause mine can't do 4k HDR on this video lol.
I have 4 Yubikeys I use for PGP but I'm not going to set them up with my Apple ID. No fallback puts me off.
What do you mean by that?
@@9to5Mac I mean iCloud does not automatically fallback to the 6 digit code on devices not capable of using security keys. I would have to remove the keys everytime I want to login to iCloud Windows or my iPad Mini 2 (ios 12). I think Apple may change this behaviour in the future and it's secure enough for me already.
Trashcan Mac so can't use keys for everything else but still use the old Mac?
Great detailed well presented explanation. This was a great video. Keep them coming
Man this HDR is 🔥
This channel tells me about the iPhone accessories I never knew I needed 😂
So what happens when you lose your keys?
You create a new Apple id and start over.
So what happens if your phone and apple key is stolen from you?
You still have the first factor, your password.
Why don’t they build one of these NFC security keys into an AirTag so then I just have to carry that around
cause everyone can use it then
Great idea I’m sure it’s coming. Lol First they created the problem then created the solution. This is step one offering a new security option but it needs a key.. next comes “air tags pro” all the tracking plus nfc key functionality. Won’t as concerned about losing security key.. can even make other existing air tag automatically be backup with a nice automatic tap function. Oh it’s coming lol
@@hallo_ween07 as opposed to the NFC/lightning security key that is clearly only for Apple users. How would the AirTag NFC security key be any different?
@@Panther1th yes please then I’ll get one
Yeah in that case airtag 2nd generation will be 300 usd.😂😂😂
What if these security keys stop working one day?
yubico estimates the life expectancy of their keys to 30+ years.
yubico estimates the life expectancy of their keys to 30+ years. But you should have backup keys.
Beware, yubico is NOT compatible with recent iPad usb-c. iPad Lightning works fine ... weird!
Still?
The best video on internet
oh please…
I am hoping this new feature is usable as a replacement for the 4/6 digit code of the device itself (when biometrics don't work) and for the new iCloud encryption feature so I don't have to search for the massive number that you are required to remember.
no, this doesn't replace the need to store (I'm not sure it's possible to remember) the recovery code somewhere safe.
@@senchaholic I misspoke, I mean I hope it will be an option in the future along with other security/device functions.
😍😍😍🤠🤠🤠😎😎😎
Did you just leak your phone number at 2:45 ?
The fact that you can't use Apple applications on Windows with this enabled is simply ridiculous.
It looks like you can remove the keys with just the device passcode. That seems to defeat the purpose because if someone steals your phone and has your device passcode, not even the Apple ID password, that’s enough to remove any added protection from the keys.
Yes, that’s the way it looks to me too. I thought these keys might be the solution to the problem you mention but I think not now having watched this. WSJ has done a piece on theft of passcode + phone.
@@bluemason I just watched that video and came here to see if security keys could help, but it doesn’t seem like it.
I know right! Seems like a massive fail on apples part to not make you authenticate with one of the keys before you can remove them both 🤦♂️🤦♂️🤦♂️🤦♂️🤦♂️
If you know the pin of the phone you can remove the keys. What were they thinking. Useless feature
No
I’m gonna wait. When Apple adopted Qi charging we suddenly see a flux of new wireless charging accessories that are innovative and great. The same will be true for fido keys I’m pretty sure more nicer looking ones will come out soon. I’d probably go for something that looks like a normal card that I can keep in my wallet.
already available to buy
Why would apple allow you to remove the keys without first you authenticating with one of the keys? Seems like a massive fail I wanted to set this up in case someone steals my phone and knows my pin so they can’t take over my account. I guess apple were not thinking about physical thefts with this new security keys feature. Hopefully in a future iOS update they can add this it then would be perfect attackers couldn’t just remove your keys then change your Apple ID password.
If you know the pin of the phone you can remove the keys. What were they thinking. Useless feature
Why would I use a key that I could lose (yes, I’m that stupid) when I can just get Apple to send me a 6-digit security code to a trusted device? What am I missing …I don’t get it 🤔
That's the thing, physical keys aren't as convenient. However, if you're extremely concerned about security, physical keys are more secure, because they are not susceptible to phishing attacks where a bad actor could intercept your 6-digit code, and use that to access your account. The likelihood of that happening is slim, but if you're a high profile target, that likelihood rises slightly.
If you have one phone with 2FA activated and loose that, you're going to have issues logging in to your icloud account. Having the 2FA solution separate from your phone feels better to me.
What if I had an iPhone 7
I was robbed a while ago and they demanded my passcode at gunpoint. They then used the code to reset my Apple ID by using the trusted device PIN codes on the phone they had stolen. Once they reset that they were able to turn off find my, which meant I was no longer covered by apple care theft and loss. With a security key like this left at home, they would have been able to do much less damage, as I would have been able to put the device in lost mode. This setup could save you >$1000 for a new phone, and possibly more by cutting off identity theft possibilities.
Recent under iOS 17.4, you are made to wait 1 hour before you can change your password.
You realize you just published your number right?
Oh God. 23 minute video. Let me get a scotch first.
Imagine you devices are stolen together with this key device, now what 😅
That's why you have a backup in another location.
Useless and if i have to carry around another device. I would it find better, if the iPhone itself could be used as FIDO2 Key
That’s what the six digit codes are for essentially. You already use your iPhone or other verified device as a key.
@@9to5Mac as FIDO Key?
The fact that they bothered to create custom messages that acknowledge the existence of security keys on older versions, yet they won't let those sign in just shows this is just another poor attempt by Apple to forcefully get you onto the latest version of the OS, as it's customary for them.
16.2 is not a firmware, it's a version of the OS.
I don’t see myself ever using a security key. I’ve never owned a set of keys in my entire life. Every lock I’ve used since 2014. It’s been digital before then I still didn’t own key as I was a child. I haven’t used any physical credit cards or money since 2015 I haven’t used a real physical pen or pencil or paper since around 2010.
Weird flex but ok
Bully for you 🙄