I think the most annoying part of this is that you cannot just replace a YubiKey.
Regardless of whether you're using passkeys or the non-discoverable ones, you need to manually go through each account and replace the YubiKey with a non-vulnerable key before decommissioning this one.
And then there is the non-discoverable part. I don't remember where I've used my YubiKey in the past.
Also, on the Ars article [0] there is mention of a PIN:
> YubiKeys provide optional user authentication protections, including the requirement for a user-supplied PIN code or a fingerprint or face scan.
This is not a YubiKey thing, but a FIDO thing [1].
Regardless of whether you're using passkeys or the non-discoverable ones, you need to manually go through each account and replace the YubiKey with a non-vulnerable key before decommissioning this one.
And then there is the non-discoverable part. I don't remember where I've used my YubiKey in the past.
Also, on the Ars article [0] there is mention of a PIN:
> YubiKeys provide optional user authentication protections, including the requirement for a user-supplied PIN code or a fingerprint or face scan.
This is not a YubiKey thing, but a FIDO thing [1].
[0]: https://arstechnica.com/security/2024/09/yubikeys-are-vulner...
[1]: https://new.reddit.com/r/yubikey/comments/12bv4sv/fido_pin_s...