Thank you for the added feedback so far everyone!

This may be obvious, but there is one thing to mention in response to @Burt's post. YubiKey support for mSecure would not actually provide a greater level of protection for your financial information. It would only provide greater protection for the data stored in mSecure, but that data is only a record of the credentials used for your actual accounts. For example, if you have a weak password being used for one of your bank accounts (which is probably unlikely, I know), then YubiKey support for mSecure won't help protect your bank account from being hacked. It would only help the weak credentials stored in mSecure from being discovered. To actually make those weak credentials stronger, you could use YubiKey directly on the bank account if it was supported by the bank's website. Of course, the most secure thing to do would be to make sure the password on the account was very strong, add YubiKey as a second factor of authentication for the bank account itself, then store the credentials in mSecure. At that point, YubiKey support for mSecure would make a difference but only marginally, since even if a thief had access to your bank's credentials through your mSecure app, they still wouldn't be able to get into your bank account without your YubiKey.

So far as I can see, the most important use case for providing protection to your online accounts with YubiKey support in mSecure is as follows. You make sure to have a very strong password set for your bank account that doesn't have direct YubiKey or 2-factor support. Then you store your bank's credentials in mSecure. At that point, the only way to get to your bank account is through either some type of brute force attack directly on the site which is highly unlikely to succeed, or to find the credentials in your password manager. If the password manager is secured with a strong password, it's already next to impossible to get access to the app. However, with a YubiKey, you could have a more memorable password to unlock mSecure, but it would still be safe, because the app can't be opened without your YubiKey.

There's something very important to remember though. For mSecure, the data is protected by an incredibly strong key called your Account Key, which is a randomly generated key. That protects your data stored in any cloud service from being compromised. Locally on your device, however, the security is a bit different. While the same key is used to protect your information, that key is encrypted with your account's password. So if you were to use a weaker password to unlock mSecure thinking that the YubiKey keeps you safe, that's only half correct. It would keep you safe from thieves getting access to your mSecure app, but it would make the data stored locally less secure. In the end, it is always best to have a very strong password set for EVERY access point to your sensitive information. That means a strong password for each online account, 2-factor authentication set directly on each account, and a strong password set for your mSecure account. If any of those passwords are made weaker for the sake of convenience, the security for your accounts is also weakened.

Hi Melani,

mSecure does have the feature you talking about. Simply add a field to your record, and set it to the "One-Time Password" type. After you do that, you'll be able to use that record for two-factor authentication as long as the account you are using supports it.

No problem at all @Jason! Some features like are a bit hidden and don't get a lot of attention on our site. It's only mentioned briefly at the bottom of the Features page on our site.

@Manoj We are aware that other password managers have implemented Yubikey support for Mac, but it is not apparent how they were able to accomplish this. The documentation for the support does not provide a way to incorporate the Yubikey SDK directly inside Xcode, which is the main development tool for macOS. So far as we can tell, the only way to implement support is via some type of .NET integration, which would require a large-scale change to mSecure's architecture. We don't know how the other password managers implemented the feature, and it's not something they publish for their competition to see.

We haven't ruled out implementing the feature, but we weren't able to add it into version 6.1. Also, we do have questions now that every Mac developed with an M1 CPU will have Touch ID support. Since these Mac's moving forward will have a biometric authentication mechanism, do you feel it necessary to have an external dongle from Yubikey essentially offering the same type of security? If so, can you explain that in some detail?