I am considering purchase of two 5C Yubikeys (one extra for backup) to secure important accounts - brokerage, email ID.me, login.gov, etc. I understand how Yubikey works when directly accessing a simple login account, but how would Yubikey work for “indirect” access to email accounts such as gmail or fastmail accounts accessed through Apple Mail on a Mac, iPhone or iPad?
Using a Fastmail account in Apple Mail requires setting up an app specific password on the Fastmail account.
I believe you could use the Yubikey as a FIDO2 (Passkey) device (alternatively as a 2FA TOTP device) to log into the account in a browser but third party mail clients need the app specific password.
1 Like
Correct!
(I use a YubiKey as a passkey to log in on the Fastmail web site), but (unique) app passwords for each third party app that needs to access my mail/calendar/contacts.
Correct! (I use a YubiKey as a passkey to log in on the Fastmail web site), but (unique) app passwords for each third party app that needs to access my mail/calendar/contacts.
@JoePreiser @rob Thank you, and yes, understand about app-specific password is needed to access Fastmail through a third party email client. There is also a procedure to setup and apply a “configuration profile” for a streamlined setup of a Mac or IOS device.
My conclusion is that neither of these methods can deal with a Yubikey.
Neither my wife nor I want to use web browser-based email, so maybe Yubikey is not for us.
There are Fastmail apps for different OSes. I have not used more than the iOS client though and that’s mainly to triage my Spam folder periodically. Perhaps those will work with a Yubikey if switching from Mail.app is an option.
Yes, you can use a YubiKey (or a passkey) to log in into the iOS and macOS Fastmail apps (which are just wrappers around their web interface).
Of course it depends on your use case, but I logged in once on both apps (long time ago) and never log out (only did that now, to verify my statement).