If you have to ask, get the super cheap ones; you probably aren't going to use any of the features on the expensive ones (like the nanos and the Y4s).

You will read lots of people talking about the cool things they do with their Y4s, but really they're just doing it because they can, not because there's a well-thought-out security benefit they're getting (I'm as guilty of this as anyone). 95% of the benefit of a security key is simply U2F.

I use Yubikeys to store my GPG and SSH private keys. This way even if my laptop gets 0wned, the attackers won't be able to get my private keys. It basically is a more convenient form factor then using a Smartcard (which was how I had previously stored by GPG / SSH keys).

Is there any simple way to keep SSH keys synced across multiple keys?

I have 2 laptops and an Android device, so if I was to start using these things it would be convenient to keep my private keys available across them all.

I don't think it's so much about features, but I do think there's a huge difference between having a nano and a normal sized one, especially on a laptop.

Being able to leave it in instead of having to take it out of your wallet and plug it in every time makes a big difference in usability, which in turn makes it much more likely that you'll want to use it everywhere.

It's funny because I see it the opposite way: the problem with the nano is you'll want to leave it in all the time, which reduces your practical security. I go out of my way to keep the security key on my physical keychain; I don't even like leaving it in my bag, where it might get stolen along with the computer.

What's the threat model this protects against?

(In other words, what's better about having the security key being on your keychain vs. be a permanent part of your computer)

I am less likely to lose both at the same time as I am to lose just one, and you'd need both of them to get access to accounts.

What do you mean you need both? The two in 2-factor is password + ubikey, not laptop + ubikey.

If someone gets your laptop with ubikey inside, they can't do anything without your password. And the whole point of a physical second factor is to basically limit the 99.9% of the people (mostly from other countries and cities) that have no physical access to you from hacking you.

It's "Yubikey", not "ubikey". The Nano and Y4 keys do more than U2F; they also generate and store RSA keys. They aren't just 2FA devices; they're also small HSMs.

If I have access to someone else's laptop with a nano key plugged into it, can I access all the SSH key files stored on the key, or are they also protected from access somehow?

Yubico Fido keys (Security Key by Yubico, the blue ones) only support FIDO U2F. This lets you use them for logging into GMail, DropBox, and other websites which support FIDO U2F. You can't store passwords or other data on them. This means you can't use them for storing SSH keys or things like that. There's not some technical reason why you can't use FIDO U2F for SSH authentication, it's just that the software support isn't there yet. You could probably hack this together yourself, the idea would be that you generate a SSH key on your computer, authenticate to some certificate manager with U2F, and then use that to install the public key on the computers you want to access. You could then have it automatically expire 8h later, forcing you to reauthenticate, giving attackers a shorter window to compromise your machine if they want to hop to others with SSH.

The cheapest way to get a yubikey in the US right now is to subscribe to wired for $10 for a year. You get a free YubiKey 4 within a month of your subscribe date.

The U2F-Zero is about $9, and the cheapest U2F device I know of. They work well, but aren’t as durable as other options.

https://www.amazon.com/U2F-Zero/dp/B01L9DUPK6

The $20 Yubikeys only do U2F; the more expensive Yubikeys also have the ability to generate one-time passwords and act as smartcards (for things like signing git commits).

I have the Nanos in all my computers because I'm used to that setup from working at Google, but that's more expensive than what I actually need.

So you leave it plugged in all the time?

Yes.

I looked in to it a while ago, but none except for portability. The Nano's are designed to take up a USB slot and be semi-permanent in there. That is, they can be removed, but its not as easy as removing a normal USB key. Either good grip or a pair of pliers for the fingernail-less.

And you have to be very delicate when using tools on it or else you'll chip away at it. I've found needle and thread to be effective.

yeh this is probably miles better than what I do to my Nanos.

I‘d like to add a related question: I already have three or four U2F keys. Is there any reason to upgrade to FIDO2 keys?

Not yet. I'm writing a Django library for webauthn support (i.e. logins without usernames or passwords), but no browser supports that yet, that I can see. They only support the second-factor mode, not the first-factor.

If you request resident keys the browsers seem to switch over. Chrome Canary had it hidden behind a command-line flag last I checked (a month ago, which is an eternity considering how hard they are pushing)

Yeah looks like it is now chrome://flags/#enable-web-authentication-ctap2-support

That's fantastic to know, thank you!

Unfortunately the $20 one is only available with USB-A, not USB-C.