Lion Cipher Lab

Set up a hardware security key on your own accounts

• Identity & Access Management
• Beginner
• ~30-45 min (plus shipping time for the key)
• Free · no account required

Why it matters

Most account takeovers do not involve anyone cracking anything. They happen because a real person is tricked into typing a real secret -- a password, or even a texted or app-generated one-time code -- into a fake login page that looks exactly like the real one. That trick is called phishing, and it defeats the everyday second factors most people rely on. A hardware security key is the answer to it. It is a small physical object -- you may know the brand name YubiKey, but any FIDO2/U2F key does the job -- that you plug into a USB port or tap against your phone to prove it is really you.…

What you'll learn

• what a hardware security key is and how it differs from an app code or a platform passkey
• FIDO2 and U2F in plain language (the standards a security key speaks)
• roaming authenticator vs platform authenticator (a key you carry vs your phone/laptop)
• why a hardware key is the strongest phishing-resistant second factor (domain binding)
• buying a reputable FIDO2/U2F key and choosing the right connector (USB-A, USB-C, NFC, Lightning)
• registering a security key on a real account (Google / GitHub / Microsoft)
• registering a SECOND key or backup method so a lost key never locks you out
• using a security key as a second factor and, where supported, for passwordless sign-in

Steps in this lab

1. What a hardware security key is, in one plain paragraph
2. The standard it speaks: FIDO2 and U2F (and why that matters)
3. Roaming vs platform: why a physical key you carry is different
4. Why a hardware key cannot be phished: it is bound to the real site
5. Buy a reputable key -- exactly what to get
6. Pick one account and open its security settings
7. Register the key -- what each prompt means
8. Register a SECOND key or backup so you are never locked out
9. Sign in with your key and watch the flow
10. What you just did -- and where to take it

Open the full interactive lab →