I have a YubiKey 5c nano attached to my laptop used for 2FA, etc. It works great and is unobtrusive, but I feel like the small form factor encourages leaving it plugged into the laptop all the time, essentially weakening the two-factor nature of they key... or effectively making my laptop the second factor.

I have Yubico Authenticator set to protect the Yubikey with a password so that if my laptop were stolen, the Yubikey is unusable without the password. But once the password is entered, the Yubikey is usable until unplugged (or the machine is shut down) and I am worried that I may forget to unplug the Yubikey before traveling.

Is there any way to "lock" a Yubikey and require the password after some period of inactivity, or via a CLI-interface? I'm on Mac OS X and could write a shell script, but an OS-angnostic answer would be more useful to the community.

2 Answers 2


You misunderstand the threat model. Making your laptop the second factor doesn't weaken the 2FA at all. An attacker would still need to both know the password to unlock your laptop's user account (factor 1) and physically possess your laptop with the YubiKey in it (factor 2).

  • Thanks Joseph. I get your point, but I guess what I really wanted was for the Yubikey to be a separate form of "something I have" than just my laptop... Maybe I am extra paranoid but having my laptop alone be the second factor still made me uneasy.
    – Josh
    Mar 5, 2020 at 21:21
  • @Josh If you want that, then you have to take the YubiKey out. By locking it, it instead just becomes a second password, which adds inconvenience but no security. Mar 5, 2020 at 21:23
  • I agree, and I try to remember to take it out when traveling, but the nano is so small and I'm human and sometimes forget. I do get that locking the yubikey is sub-optimal, but now it's two passwords that need to be known (in the instance that I forget to keep the yubikey with me)
    – Josh
    Mar 5, 2020 at 21:25
  • @Josh My point is that there's virtually no scenarios in which an attacker can learn one of your passwords but not the other. And if you're thinking about guessing, then you'd be better off with one long one rather than two short ones, due to the possibility of guessing in pieces. Mar 5, 2020 at 21:26
  • I get your point. Call this an exercise in making me feel better while adding no additional security then :) Maybe the inconvenience of two passwords will train me to always remove the yubikey and I'll disable the cronjob I set up.
    – Josh
    Mar 5, 2020 at 21:29

Understanding @Joseph's point, I was still concerned...

I discovered that actually, simply quitting the Yubico Authenticator GUI will require the password set on the OATH applet when it's relaunched. It appears to store the OATH application password in memory, because ykman oath code asks for the password every time it's run.

Given this, it was very simple to create a small cron job which runs every minute, checks the idle time on the GUI and runs killall yubioath-desktop 2> /dev/null is the idle time is greater than a configured value.

This provides what I was looking for.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .