popularswaroopsam31 posted Nov 30, 2025 05:31 AM
Item 1 of 2
Item 1 of 2
popularswaroopsam31 posted Nov 30, 2025 05:31 AM
Yubikey 5C NFC (2 Pack) $69.99
$70
$100
30% offBest Buy
Get Deal at Best BuyGood Deal
Bad Deal
Save
Share
Deal Details
Free pickup and free shipping. Single is available from $38.50.
https://www.bestbuy.com/product/y...CLXCPZHZT8
https://www.bestbuy.com/product/y...CLXCPZHZT8
Community Notes
About the Poster
Deal Details
Community Notes
About the Poster
Free pickup and free shipping. Single is available from $38.50.
https://www.bestbuy.com/product/y...CLXCPZHZT8
https://www.bestbuy.com/product/y...CLXCPZHZT8
Community Voting
Deal Score
+31
Good Deal
Bad Deal
$36McCafe Premium Roast Coffee, Keurig Single Serve K-Cup Pods, Medium Roast, 96 Count~$35.88 With S&S @ Amazon
2
There is no voting data on this thread
$4.21$6.4734% off8-Pack 12-Oz BODYARMOR Sports Drink Beverage (Strawberry Banana) $4.21 (53c Ea) w/ S&S + Free Shipping w/ Prime or on $35+
0
There is no voting data on this thread
$14$5072% offSolpowben 20000mAh Solar Power Bank with 2 Flashlights and Compass $14.19
4
There is no voting data on this thread
$15$3557% offCasper Essential Fiber Bed Pillow (Standard) $15 + Free S&H w/ Walmart+ or on $35+
1
There is no voting data on this thread
$35$7050% offTaylorMade Golf 2025 British Open Rescue Headcover $34.99 + Free Shipping w/ Prime or on $35+
3
There is no voting data on this thread
$606$1,00039% off2021 Apple M1 Pro MacBook Pro 14" 16GB/512GB SSD - (Space Gray) - Refurbished $606.06 at Tek Deals Store via eBay
8
There is no voting data on this thread
$14Pulp Fiction 4k UHD Blu Ray Digital Code $14.23 Free Shipping Amazon Prime
3
There is no voting data on this thread
$160$35054% offToshiba - 50" Class C350 Series LED 4K UHD Smart Fire TV
4
There is no voting data on this thread
Leave a Comment
23 Comments
Sign up for a Slickdeals account to remove this ad.
Our community has rated this post as helpful. If you agree, why not thank LavenderPickle7682
Exception #1: If you're a business using it to access your intranet/private network, absolutely useful.
Exception #2: You deal with large amounts of money through banking/investment organizations who support hardware keys.
Most normal consumers: You'll make your life miserable trying to implement this.
There are VERY precious few consumer sites which allow hardware tokens like this -- and most of them don't even allow two of them for redundancy! This means all your eggs are in one basket. And if you break/lose that singular key, your life will become a nightmare for the next two weeks as you jump through endless hoops to prove your identity....if you even can recover the account.
--------
Here's something I've said elsewhere, and I'll repeat here.
--------
For 90-99% of people, they'll be mostly fine if they do these password best practices:
-General Approach-
--> Be thoughtful. Use NOTHING immediately guessable to your online "persona", geography, age, school, real name, etc.
--> Reuse nothing between services. This is called compartmentalization - so that if anything gets compromised, it minimizes any fallout.
--> Randomization and obfuscation are your friends. No one can guess what you are doing if you don't know what you're doing.
--> Trust no one. Treat everything as if it's a hostile actor...every email, every text, every phone call, every website. It's not paranoia -- they really are out there to get you.
--> Speaking of hostile actors -- the official ones are the worst. Orwell's 1984 apparently was an instruction manual. Police, Customs, etc will enthusiastically take your device and image it. Don't use biometrics -- have a 6+ character passphase locking every device. Assume that your physical device (and any accounts/details on them) are completely compromised once the mobile is confiscated from your possession -- TRASH IT. Use a "burner" device and accounts when you travel just for this potential situation. Many businesses mandate this when traveling to hostile countries like China, Russia, or the United States.
--> Adopt an allow-list mentality, blocking everything else until absolutely PROVEN BEYOND A DOUBT to be safe. And even then, assume they don't care about keeping your data private.
-Specific Actions-
1. Use a password manager for:
- strong, unique, randomized passwords
- randomizing security questions and their answers
- usernames - no username should be used twice
- use different, randomly generated email addresses for each service (and the same for secondary recovery emails) -- especially for important categories like: medical, banking, investments, insurance, etc. And segregate those from your personal email, retail mailing lists, online shopping, etc.
--> Bitwarden is free. 1Password is a popular paid option. They have free trials. Just give them both a whirl.
--> Make a calendar entry to check your accounts every 30-90 days, as some services may time-out inactive accounts.
2. Use a form of 2FA whenever available, such as emailed one-time-code or authenticator application like Authy/Google Authenticator/Microsoft Authenticator.
--> SMS is the worst method to use -- I'd avoid it since mobiles are an easy target for theft and spoofing. SMS ties you to a singular device, and single points of failure are the bane of security.
--> Furthermore, using mobile as a "pass key" is becoming the newest hot fad...let me know how that works out when you drop your phone or leave it behind somewhere or have it stolen when traveling. Recovering from that is almost as bad as recovering from a lost singular Yubikey.
--> At least with software authenticators, you can install them on multiple devices (primary phone, backup mobile, tablets, etc). Those $30 Tracfone deals from HSN and QVC? Buy one of them and don't even bother to activate them on a mobile network -- use them as a mobileOS wifi-only device.
3. Only access critical/essential services from a single, secure location (home), on a secure desktop/laptop, on a known secure WIRED network. Bonus points if you have a separate computer just for accessing these services -- one that isn't used daily as a general machine. All of this greatly reduces your exposed attack surface.
--> Yes. That means taking your medical and banking information OFF your mobile phone. You know, that fragile dainty device that sometimes has glass on BOTH sides, that's often 5+ feet above the ground, and is a hot target for thieves. You don't NEED those accounts on the go. So don't take them with you. Mobile is inherently insecure due to it's very nature -- so don't put anything on it that you wouldn't want a random stranger finding.
--> Being dependent on Mobile Networks can be even a further risk. It neglects the fact that not everyone has readily access to mobile technology -- that could be due to cost or network coverage (rural areas or foreign travel). And you can have a hiccup in your mobile provider -- which locks you out of everything tied to it. It's an authentication method that's dependent on many things, including your ability to continually pay money every month. And some places refuse to cooperate with VOIP (Google Voice) or pre-paid cellular options (Tracfone, SimplyMobile, Cricket, etc). Mobile is great while it works properly...until it doesn't, then it becomes an unmitigated nightmare. Don't tie any authentication to mobile unless you have a backup unit in safe place -- assume mobile can be stolen/lost at any time. (it's like a house key. keep one on your keyring, and another stored in a hidden safe place on your property. make sure it still works from time to time.)
4. STOP visiting unknown sites/scanning QR codes/using free wifi/opening attachments in emails. It's like licking random bathroom surfaces. Eww.
5. Use a popular advert blocker, such as uBlock Origin. So many adverts contain malicious payloads -- even a few of the three-letter US government security/investigative agencies openly recommend using advert blockers as a standard practice. It's not theft, it's not piracy -- it's called protecting yourself in a hostile world.
--> Some people use other tools like script blockers or network-based advert blockers like the PiHole. They are good tools, but a bit harder to implement and even more so to troubleshoot if there's a hiccup or a false-positive blocking. UBlock Origin is an easy-to-install browser plugin that's ridiculously effective and rather easy to manage/turn off + on. It covers 99% of issues and is simple to use...take the easy win. Expand with other tools later if you need more. You probably won't.
------
For anyone who says "woah, that's way too much" -- dude, you're on a thread talking about using a $50+ USB hardware token for secure access to internet sites. You should be ALREADY doing the above things in addition to the Yubikey, if that product appeals to you.
------
edit: no idea why the downvotes. none of this was written to be disrespectful. anyone care to comment as to why?
Exception: If you're a business using it access your intranet/private network, absolutely useful.
Most normal consumers: You'll make your life miserable trying to implement this. The VERY precious few places that allow hardware tokens like this don't even allow two of them! Which means all your eggs are in one basket. And if you break that singular key, your life will become a nightmare for the next two weeks as you jump through endless hoops to prove your identity. If you even can recover the account.
--------
Here's something I've said elsewhere, and I'll repeat here.
--------
For 90-99% of people, they'll be mostly fine if they do these things:
--> Be thoughtful. Use NOTHING immediately guessable to your online "persona", geography, age, school, real name, etc.
--> Reuse nothing between services. This is called compartmentalization - so that if anything gets compromised, it minimizes any fallout.
--> Randomization and obfuscation are your friends. No one can guess what you are doing if you don't know what you're doing.
--> Trust no one. Treat everything as if it's a hostile actor...every email, every text, every phone call, every website. It's not paranoia -- they really are out there to get you.
--> Speaking of hostile actors -- the official ones are the worst. Orwell's 1984 apparently was an instruction manual. Police, Customs, etc will enthusiastically take your device and image it. Don't use biometrics -- have a 6+ character passphase locking every device. Assume that your physical device (and any accounts/details on them) are completely compromised once the mobile is confiscated from your possession -- TRASH IT. Use a "burner" device when you travel just for this.
--> Adopt an allow-list mentality, blocking everything else until absolutely PROVEN BEYOND A DOUBT to be safe. And even then, assume they don't care about keeping your data private.
1. Use a password manager for:
- strong, unique, randomized passwords
- randomizing security questions and their answers
- usernames - no username should be used twice
- use different, randomly generated email addresses for each service (and the same for secondary recovery emails) -- especially for important categories like: medical, banking, investments, insurance, etc. And segregate those from your personal email, retail mailing lists, online shopping, etc.
--> Bitwarden is free. 1Password is a popular paid option.
--> Make a calendar entry to check each of these accounts between 30-90 days, as some services may time-out inactive accounts.
2. Use a form of 2FA whenever available, such as emailed one-time-code or authenticator application like Authy/Google Authenticator/Microsoft Authenticator.
--> SMS is the last ditch method -- avoid it since mobiles are a target for theft and spoofing. Using mobile as "pass key" is becoming the newest hot fad...let me know how that works out when you drop your phone or leave it behind somewhere or have it stolen when traveling. Recovering from that is almost as bad as recovering from a lost singular Yubikey.
--> At least with software authenticators, you can install them on multiple devices (primary phone, backup mobile, "I"-Pad, etc). Those $30 TrackPhone deals from HSN and QVC? Buy one of them and don't even bother to activate them on a mobile network -- use them as a mobileOS wifi-only device.
3. Only access critical/essential services from a single, secure location (home), on a secure desktop/laptop, on a known secure WIRED network. Bonus points if you have a separate computer just for accessing these services -- one that isn't used daily as a general machine. All of this greatly reduces your exposed attack surface.
--> Yes. That means taking your medical and banking information OFF your mobile phone. You know, that fragile dainty device that sometimes has glass on BOTH sides, that's often 5+ feet above the ground, and is a hot target for thieves. You don't NEED those accounts on the go. So don't take them with you. Mobile is inherently insecure due to it's very nature -- so don't put anything on it that you wouldn't want a random stranger finding.
4. STOP visiting unknown sites/scanning QR codes/using free wifi/opening attachments in emails. It's like licking random bathroom surfaces. Eww.
5. Use a popular advert blocker, such as uBlock Origin. So many adverts contain malicious payloads -- even a few of the three-letter US government security/investigative agencies openly recommend using advert blockers as a standard practice. It's not theft, it's not piracy -- it's called protecting yourself in a hostile world.
For anyone who says "woah, that's way too much" -- dude, you're on a thread talking about using a $50+ USB hardware token for secure access to internet sites. You should be ALREADY doing the above things in addition to the Yubikey, if that product appeals to you.
Exception #1: If you're a business using it access your intranet/private network, absolutely useful.
Exception #2: You deal with large amounts of money through banking/investment organizations who support hardware keys.
Most normal consumers: You'll make your life miserable trying to implement this. The VERY precious few consumer places that allow hardware tokens like this don't even allow two of them! Which means all your eggs are in one basket. And if you break that singular key, your life will become a nightmare for the next two weeks as you jump through endless hoops to prove your identity. If you even can recover the account.
--------
Here's something I've said elsewhere, and I'll repeat here.
--------
For 90-99% of people, they'll be mostly fine if they do these things:
--> Be thoughtful. Use NOTHING immediately guessable to your online "persona", geography, age, school, real name, etc.
--> Reuse nothing between services. This is called compartmentalization - so that if anything gets compromised, it minimizes any fallout.
--> Randomization and obfuscation are your friends. No one can guess what you are doing if you don't know what you're doing.
--> Trust no one. Treat everything as if it's a hostile actor...every email, every text, every phone call, every website. It's not paranoia -- they really are out there to get you.
--> Speaking of hostile actors -- the official ones are the worst. Orwell's 1984 apparently was an instruction manual. Police, Customs, etc will enthusiastically take your device and image it. Don't use biometrics -- have a 6+ character passphase locking every device. Assume that your physical device (and any accounts/details on them) are completely compromised once the mobile is confiscated from your possession -- TRASH IT. Use a "burner" device and accounts when you travel just for this potential situation. Many businesses mandate this when traveling to hostile countries like China, Russia, or the United States.
--> Adopt an allow-list mentality, blocking everything else until absolutely PROVEN BEYOND A DOUBT to be safe. And even then, assume they don't care about keeping your data private.
1. Use a password manager for:
- strong, unique, randomized passwords
- randomizing security questions and their answers
- usernames - no username should be used twice
- use different, randomly generated email addresses for each service (and the same for secondary recovery emails) -- especially for important categories like: medical, banking, investments, insurance, etc. And segregate those from your personal email, retail mailing lists, online shopping, etc.
--> Bitwarden is free. 1Password is a popular paid option.
--> Make a calendar entry to check each of these accounts between 30-90 days, as some services may time-out inactive accounts.
2. Use a form of 2FA whenever available, such as emailed one-time-code or authenticator application like Authy/Google Authenticator/Microsoft Authenticator.
--> SMS is the last ditch method -- avoid it since mobiles are a target for theft and spoofing. Using mobile as "pass key" is becoming the newest hot fad...let me know how that works out when you drop your phone or leave it behind somewhere or have it stolen when traveling. Recovering from that is almost as bad as recovering from a lost singular Yubikey.
--> At least with software authenticators, you can install them on multiple devices (primary phone, backup mobile, "I"-Pad, etc). Those $30 TrackPhone deals from HSN and QVC? Buy one of them and don't even bother to activate them on a mobile network -- use them as a mobileOS wifi-only device.
3. Only access critical/essential services from a single, secure location (home), on a secure desktop/laptop, on a known secure WIRED network. Bonus points if you have a separate computer just for accessing these services -- one that isn't used daily as a general machine. All of this greatly reduces your exposed attack surface.
--> Yes. That means taking your medical and banking information OFF your mobile phone. You know, that fragile dainty device that sometimes has glass on BOTH sides, that's often 5+ feet above the ground, and is a hot target for thieves. You don't NEED those accounts on the go. So don't take them with you. Mobile is inherently insecure due to it's very nature -- so don't put anything on it that you wouldn't want a random stranger finding.
4. STOP visiting unknown sites/scanning QR codes/using free wifi/opening attachments in emails. It's like licking random bathroom surfaces. Eww.
5. Use a popular advert blocker, such as uBlock Origin. So many adverts contain malicious payloads -- even a few of the three-letter US government security/investigative agencies openly recommend using advert blockers as a standard practice. It's not theft, it's not piracy -- it's called protecting yourself in a hostile world.
For anyone who says "woah, that's way too much" -- dude, you're on a thread talking about using a $50+ USB hardware token for secure access to internet sites. You should be ALREADY doing the above things in addition to the Yubikey, if that product appeals to you.
------
edit: no idea why the downvotes. none of this was written to be disrespectful. anyone care to comment as to why?
Sign up for a Slickdeals account to remove this ad.
Exception #1: If you're a business using it access your intranet/private network, absolutely useful.
Exception #2: You deal with large amounts of money through banking/investment organizations who support hardware keys.
Most normal consumers: You'll make your life miserable trying to implement this. The VERY precious few consumer places that allow hardware tokens like this don't even allow two of them! Which means all your eggs are in one basket. And if you break that singular key, your life will become a nightmare for the next two weeks as you jump through endless hoops to prove your identity. If you even can recover the account.
--------
Here's something I've said elsewhere, and I'll repeat here.
--------
For 90-99% of people, they'll be mostly fine if they do these things:
--> Be thoughtful. Use NOTHING immediately guessable to your online "persona", geography, age, school, real name, etc.
--> Reuse nothing between services. This is called compartmentalization - so that if anything gets compromised, it minimizes any fallout.
--> Randomization and obfuscation are your friends. No one can guess what you are doing if you don't know what you're doing.
--> Trust no one. Treat everything as if it's a hostile actor...every email, every text, every phone call, every website. It's not paranoia -- they really are out there to get you.
--> Speaking of hostile actors -- the official ones are the worst. Orwell's 1984 apparently was an instruction manual. Police, Customs, etc will enthusiastically take your device and image it. Don't use biometrics -- have a 6+ character passphase locking every device. Assume that your physical device (and any accounts/details on them) are completely compromised once the mobile is confiscated from your possession -- TRASH IT. Use a "burner" device and accounts when you travel just for this potential situation. Many businesses mandate this when traveling to hostile countries like China, Russia, or the United States.
--> Adopt an allow-list mentality, blocking everything else until absolutely PROVEN BEYOND A DOUBT to be safe. And even then, assume they don't care about keeping your data private.
1. Use a password manager for:
- strong, unique, randomized passwords
- randomizing security questions and their answers
- usernames - no username should be used twice
- use different, randomly generated email addresses for each service (and the same for secondary recovery emails) -- especially for important categories like: medical, banking, investments, insurance, etc. And segregate those from your personal email, retail mailing lists, online shopping, etc.
--> Bitwarden is free. 1Password is a popular paid option.
--> Make a calendar entry to check each of these accounts between 30-90 days, as some services may time-out inactive accounts.
2. Use a form of 2FA whenever available, such as emailed one-time-code or authenticator application like Authy/Google Authenticator/Microsoft Authenticator.
--> SMS is the last ditch method -- avoid it since mobiles are a target for theft and spoofing. Using mobile as "pass key" is becoming the newest hot fad...let me know how that works out when you drop your phone or leave it behind somewhere or have it stolen when traveling. Recovering from that is almost as bad as recovering from a lost singular Yubikey.
--> At least with software authenticators, you can install them on multiple devices (primary phone, backup mobile, "I"-Pad, etc). Those $30 TrackPhone deals from HSN and QVC? Buy one of them and don't even bother to activate them on a mobile network -- use them as a mobileOS wifi-only device.
3. Only access critical/essential services from a single, secure location (home), on a secure desktop/laptop, on a known secure WIRED network. Bonus points if you have a separate computer just for accessing these services -- one that isn't used daily as a general machine. All of this greatly reduces your exposed attack surface.
--> Yes. That means taking your medical and banking information OFF your mobile phone. You know, that fragile dainty device that sometimes has glass on BOTH sides, that's often 5+ feet above the ground, and is a hot target for thieves. You don't NEED those accounts on the go. So don't take them with you. Mobile is inherently insecure due to it's very nature -- so don't put anything on it that you wouldn't want a random stranger finding.
4. STOP visiting unknown sites/scanning QR codes/using free wifi/opening attachments in emails. It's like licking random bathroom surfaces. Eww.
5. Use a popular advert blocker, such as uBlock Origin. So many adverts contain malicious payloads -- even a few of the three-letter US government security/investigative agencies openly recommend using advert blockers as a standard practice. It's not theft, it's not piracy -- it's called protecting yourself in a hostile world.
For anyone who says "woah, that's way too much" -- dude, you're on a thread talking about using a $50+ USB hardware token for secure access to internet sites. You should be ALREADY doing the above things in addition to the Yubikey, if that product appeals to you.
------
edit: no idea why the downvotes. none of this was written to be disrespectful. anyone care to comment as to why?
probably a good idea, since you've stored so much important info in bitwarden.
Sign up for a Slickdeals account to remove this ad.
Leave a Comment