How to use Yubikey 5 NFC for online accounts, Linux login, and KeePassXC?

Question

I just got my Yubikey 5 NFC, and would like to use it for

• Linux desktop login
• Linux KeePassXC (which only supports hmac-sha1 challenge-response)
• online accounts

When reading about U2F it seams to be the preferred protocol, but TOPT is often only supported on online accounts.

Right now I got Linux login to work with Yubico OTP.

Question

Is it correct understood that in my correct case, I would need to one more YubiKey?

2 slots seams very limited, when just U2F and TOTP would take up those two slots leaving no room for Yuboco OTP and hmac-sha1 challenge-response.

Are there some corners that could be cut?

Answer 1

For Linux desktop login, this guide worked for me: InfoSec handbook

For KeePassXC, read KeePassXC doc

For online accounts, this heavily depends on the website how they implemented it. Usually, there should be a setting somewhere. Then, you need to insert your YubiKey and press a button to register it.

Keep in mind that U2F is considered "a second factor". So you still need a strong password in addition to your U2F key.

You need more than one YubiKey (or any other U2F token) for backup purposes. If you lose your single YubiKey, you may lose access to your accounts.

U2F doesn't take any slots, so you can use one single YubiKey for an unlimited number of U2F websites, etc. TOTP and HMAC CR are limited though.