To add to the other answers, a Yubikey generally cannot emulate a different device other than a HID, such as a mass storage device as you suggested. Many large organizations deploy policies that prevent the use of removable mass storage devices by users in order to help thwart data loss. Those policies are intended to prevent a malicious user (or Bad USB cable) from downloading sensitive files locally. They also protect against users plugging in “found USB keys” that upload malware.

When such a policy is enabled, the OS will see that a new USB device is a mass storage device and will refuse to mount it. A Yubikey would be inert if it was emulating a thumb drive.

But unknown HID devices (like new keyboards) are almost always allowed because of accessibility issues. For example, if a person requires a specialized large button keyboard, a US employer is required by the ADA to permit them to use it so they can do their job.

To add to the other answers, a Yubikey generally cannot emulate a different device other than a HID, such as a mass storage device as you suggested. Many large organizations deploy policies that prevent the use of removable mass storage devices by users in order to help thwart data loss. Those policies are intended to prevent a malicious user (or Bad USB cable) from downloading sensitive files locally. They also protect against users plugging in “found USB keys” that upload malware.

When such a policy is enabled, the OS will see that a new USB device is a mass storage device and will refuse to mount it. A Yubikey would be inert if it was emulating a thumb drive.

But unknown HID devices (like new keyboards) are almost always allowed because of accessibility issues. For example, if a person requires a specialized large button keyboard, a US employer is required by the ADA to permit them to use it so they can do their job.

EDIT: HID devices are considered “mostly safe”. Since they are input-only, they cannot directly exfiltrate data from the host. However, malicious HID devices such as the Bash Bunny can send keystrokes that will attempt to open a browser, download a program, run it, upload a file full of results, then close the browser. But your suggestion of restricting unknown HID devices is not a useful defense, as the Bash Bunny can also present the PID & VID of a stock Dell keyboard, or whatever keyboard you think should be on a whitelist. At some point, you have to accept some risk when you allow HID.

There are some very high security systems that have specialty keyboard devices dedicated to secure password entry. For example HSM vendors often use an encrypted keypad for initializing security keys. But these are not HID-compliant keypads, they are separate embedded systems with a little display that prompts users for input, they do internal cryptography, then exchange encrypted data via the USB serial protocol. They may even require custom drivers to function. These are designed with nation-state level adversaries in mind.

To add to the other answers, a Yubikey generally cannot emulate a different device other than a HID, such as a mass storage device as you suggested. Many large organizations deploy policies that prevent the use of removable mass storage devices by users in order to help thwart data loss. Those policies are intended to prevent a malicious user (or Bad USB cable) from downloading sensitive files locally.

When such a policy is enabled, the OS will see that a new USB device is a mass storage device and will refuse to mount it. A Yubikey would be inert if it was emulating a thumb drive.

But unknown HID devices (like new keyboards) are almost always allowed because of accessibility issues. For example, if a person requires a specialized large button keyboard, a US employer is required by the ADA to permit them to use it so they can do their job.

To add to the other answers, a Yubikey generally cannot emulate a different device other than a HID, such as a mass storage device as you suggested. Many large organizations deploy policies that prevent the use of removable mass storage devices by users in order to help thwart data loss. Those policies are intended to prevent a malicious user (or Bad USB cable) from downloading sensitive files locally. They also protect against users plugging in “found USB keys” that upload malware.

When such a policy is enabled, the OS will see that a new USB device is a mass storage device and will refuse to mount it. A Yubikey would be inert if it was emulating a thumb drive.

But unknown HID devices (like new keyboards) are almost always allowed because of accessibility issues. For example, if a person requires a specialized large button keyboard, a US employer is required by the ADA to permit them to use it so they can do their job.