Yubi Key recommendations for my needs?

Question

Essentially, I'm looking to purchase a Yubi Key as I would like to limit the number of times I have to enter my password at home and at work. I also want to set up some applications which two factor authentication and sometimes do not carry my phone or other devices, but I always have my keys.

I have been looking at the differences and I cannot see/understand what differences there is, especially for the price.

For example, the YUBIKEY 4 comes it at roughly $40. Whereas the FIDO U2F Key comes it at $18.

So for what I want to do:

• Limit re-typing password
• Two Step factor
• Maybe Near Field Communication

I believe that the NFC would be good if I had my phone, for example I could just press the key against it. But I have the mail app so I don't see this being a major issue.

Could I therefore buy the $18 U2F key to meet my needs?

Answer 1

OK, to give you a solid understanding of which Yubikey you need you first need to understand what each single one can offer you.

In principle, there are three "levels" of functionality regarding the Yubikeys.

Level 1: U2F

All Yubikeys offer support for the U2F authentication protocol which was originally designed as a secure, anonymous second factor authentication protocol, which is deployed among others with Google, Dropbox and GitHub. Usually (I don't own one, so I can't say 100% for sure), this won't save you from entering any passwords, because it's usually only employed as second defence, especially against phishing attacks.

Level 2: OpenPGP and FIPS 201

This feature set is offered by the Yubikey Neo and the Yubikey 4. It includes integration into PGP based email encryption and signature services such as GPG and allows you to "enforce" hardware access for email signature / decryption.
Furthermore they implement the FIPS 201 standard, which means you can also use your Yubikey for encryption, authentication and signature - also using the PKCS#11 library OpenSC - possibly even for windows log-in. However chances are that only very few webservices will make use of such certificate based authentication because it brings a lot of other cost with it, and you'd probably still have to authenticate to the token with a PIN or something...
The difference between the Yubikey 4 and the Neo is that the 4 supports stronger crypto algorithms than the Neo (although the Neos are nowhere near broken).

Level 3: NFC

This feature is only offered by the (somewhat dated) Yubikey Neo and thus this is the only one being compatible with phones. So if you need your yubikey on your phone, you have to pick up the Neo.

TL;DR: If you're not interested in fancy crypto features and don't need NFC the cheapest yubikey will probably serve you best, and if you want hardware-backed email encryption and similar applications the more expensive ones are at least worth a look.

Answer 2

You will need either the Yubikey 4 or Yubikey Neo in order to use the device to store passwords or authentication tokens. The $18 U2F key will only allow you to perform U2F logins on websites (and browsers) that support it. It is not designed as a password replacement.