如何将YubiKey连接至GitHub以配置双因素认证

Hey there! I’ve set up YubiKey for GitHub 2FA multiple times, so let me walk you through the exact steps to get it working smoothly:

• Plug your YubiKey into your computer’s USB port (if it’s an NFC model, you can also tap it against a supported device later)
• No extra software is needed for the basic 2FA login setup—modern browsers like Chrome, Firefox, or Edge support FIDO2/U2F out of the box

1. Log into your GitHub account, click your profile avatar in the top right corner, and select Settings
2. On the left sidebar, navigate to Password and authentication
3. Scroll down to the Two-factor authentication section and click Enable two-factor authentication
4. You’ll first be asked to enter your GitHub password to confirm it’s you—type that in and proceed
5. Next, select the Security key option (this is the YubiKey-compatible FIDO2/U2F method)
6. Click Add, then follow the prompts:
   • Give your security key a descriptive name (like "Daily Carry YubiKey" or "Home Desktop YubiKey")
   • When your browser prompts you, touch the button on your YubiKey to complete the verification
7. Once done, GitHub will show you a set of recovery codes—save these somewhere super secure (like a password manager or encrypted note)! These are your backup if you ever lose your YubiKey.

If you want to use your YubiKey to authenticate Git commands (instead of typing tokens or passwords every time), here’s how:

• Open your terminal and run this command to generate an SSH key stored directly on your YubiKey:

  ssh-keygen -t ed25519-sk
  

  Note: If your YubiKey doesn’t support ED25519-SK, use ssh-keygen -t ecdsa-sk instead
• Follow the terminal prompts: touch your YubiKey when asked, choose a save path (the default is fine), and optionally set a passphrase for extra security
• Copy your new public key to your clipboard:

  cat ~/.ssh/id_ed25519-sk.pub
  

  (Swap ed25519-sk with ecdsa-sk if you used that earlier)
• Back on GitHub, go to Settings > SSH and GPG keys and click New SSH key
• Paste the public key into the text box, give it a name, and click Add SSH key
• From now on, when you run git pull or git push, just touch your YubiKey when prompted to authenticate

• Add multiple security keys to GitHub (e.g., one for your laptop, one for your home PC) so you’re not locked out if you lose one
• When logging into GitHub via browser, as long as your YubiKey is plugged in, you’ll just need to touch the button instead of typing a code
• If your YubiKey isn’t available, use your saved recovery codes or any backup 2FA method you set up (like an authenticator app)

内容的提问来源于stack exchange，提问作者Ruby