I wanna make more of myaccounts in the internet secure with two factor. I don’t know much about it, but found out about Fido 2 and so. The security key my webbrowser shows often is the one from Yubico (BTW, I would like to get one that works with Linux, with USB and for phone with NFC) I got concerned when I noticed that Yubico is from USA, (??) Because I think NSA and thibgs like five eyes and so. Is there actually a risk that the for example is made an backdoor in the key?
FYI: the people in here recommending the open source competitors for Yubico aren’t mentioning one thing: YubiKeys, being proprietary, support a proprietary protocol called Yubico OTP in addition to the FIDO authentication protocol that the open source competitors can do.
The reason this matters is that some applications, like the Linux Bitwarden desktop app (there are others, but this is one that I’ve had to deal with), don’t support FIDO authentication, but do support Yubico OTP. This means that, for those apps, the open source keys wouldn’t be a valid authentication method.
Granted, the number of applications like this are small, and probably grows smaller by the day, but it’s an important distinction to be aware of.