https://krash.dev/tags/identity-security/Recent content in Identity-Security on krash.devHugoen-usFri, 14 Aug 2026 08:29:09 +0530https://krash.dev/posts/yubikey-best-practices/Sun, 15 Mar 2026 00:00:00 +0000https://krash.dev/posts/yubikey-best-practices/<p>If you use a YubiKey for one-time passwords (OTP), you’ve probably done it at least once: you meant to type something, touched the key, and a long modhex string landed in Slack, a commit message, or an email. Annoying for everyone, and worse, it’s a real security risk.</p> <img loading="lazy" decoding="async" src="../images/slack-screenshot.png" alt="Slack Screenshot"><p>This post pulls together practical ways to reduce accidental triggers and what to do when a code gets out, plus how YubiOTP compares to TOTP so you can use both wisely. We also cover FIDO2 / WebAuthn and how to use them alongside OTP.</p>