Every familiar confirmation method shares one weakness: it can be talked out of you. An SMS code gets read out over the phone; an app code gets typed into a fake page. A hardware key is the only one that cannot be tricked this way, and the reason is not the user's vigilance but the design of the protocol.
Not because the owner is more careful. Because the key physically cannot answer a fake site: it checks the address itself, before signing anything.
Why phishing does not work
This is the thing worth understanding, and it takes three steps to explain.
-
The key is bound to the site's address
At registration it remembers not the service's name but the exact domain. For a fake domain it simply has no matching record.
-
The browser reports the address honestly
The address is passed to the key by the browser, not by the page. A page cannot fake it: it has no way to say “I am really the bank”.
-
No match, no signature
The key does not produce a code you could type somewhere. It signs a specific request from a specific domain. There is nothing to intercept: the signature is useless on another site.
The methods compared
| Method | Phishing resistance | If the phone is lost | Cost |
|---|---|---|---|
| SMS code | No | Lost along with the number | Free |
| App code | No — the code can be typed anywhere | Lost without backup codes | Free |
| Confirmation in a banking app | Partly — you can see what is being confirmed | Lost | Free |
| Passkey | Yes — the same protocol | Moves with the account | Free |
| Hardware key | Yes | Does not depend on the phone at all | The price of the device |
Who needs one
- The email through which everything else is recovered
- Access to money and crypto assets
- Public figures and journalists
- Administrators of sites and systems
- Anyone who has already fallen for phishing
- Forums and shops with a one-off purchase
- Services holding neither money nor personal data
- If your main accounts still have no second factor at all
The last point matters most: start not with a key but with making sure a second factor exists everywhere. A key on one account while the rest stand open gives little.
Choosing and setting up
- Buy two at once. Carry one, keep the other at home as a spare. Keys get lost like house keys, and recovery without a second one is a matter of weeks.
- A connector that fits your devices. USB-A, USB-C, wireless — check what your phone and computer take.
- Register both keys straight away. On every service where you enable it. Adding the second later requires access, and if you had access you would not need the key.
- Keep backup codes anyway. A key is no reason to give up a fallback route.