How do I use a hardware key (YubiKey)?

Why a hardware key rather than an app

The authenticator app is already very solid. But it has two theoretical weaknesses:

1. Advanced phishing: an attacker who creates a fake Ktkarena site identical to the real one can trick you into entering your 2FA code, which they immediately use on the real site. The hardware key makes this scenario impossible: it cryptographically verifies it's talking to the real Ktkarena.

2. Malware on your phone: if your phone is compromised by sophisticated malware, an attacker could theoretically read the generated 2FA codes. With a separate hardware key, the malware can't do anything.

Who it's useful for:

• Bettors with large volumes (Premium, Elite, Institutional stake tiers).
• People exposed to phishing (entrepreneurs, journalists, politicians).
• The "reasonable paranoia" profile: you want maximum security.

Who doesn't need it:

• Beginner bettors with a modest balance (the app is more than enough).
• If you find the complexity off-putting (better an app 2FA that's enabled than a hardware key 2FA never set up).

Which keys are compatible

Ktkarena supports the FIDO2 / WebAuthn standard, which is the de facto industry standard for security keys.

Recommended keys:

• YubiKey 5C / 5C NFC (Yubico, market leader). ~€50. Several ports available depending on your phone (USB-C, USB-A, NFC).
• Google Titan Security Key (Google). ~€40. Good alternative.
• SoloKey 2 (open-source). ~€30. For free software enthusiasts.

Essential criterion: the key must support FIDO2 / WebAuthn. Avoid old U2F-only keys (they work but are obsolete).

Our recommendation: buy 2 YubiKey 5C NFC. One primary, one backup stored somewhere safe (safe, binder). Total cost: ~€100.

Step-by-step setup

1. Receive your key by delivery or buy it at a computer store.
2. Log in to Ktkarena on your phone (with password + app 2FA if already enabled).
3. Go to Profile → Security → 2FA → Add a hardware key.
4. The app asks you to connect the key. Depending on the model:
   • USB-C: plug the key into your phone's USB-C port.
   • NFC: hold the key against the back of your phone (1-2 cm from the NFC zone, usually toward the top).
   • Lightning: for older iPhones with a Lightning-to-USB adapter.
5. Tap the key's button to confirm (most keys have a gold button or a touch sensor).
6. The app asks you to name your key: for example "Primary YubiKey" or "Backup YubiKey". Useful if you have several.
7. Repeat the operation for your second key (backup). It's strongly recommended.
8. Keep the recovery codes displayed (on top of your keys, that's your triple security).

Done. From now on, every login can be validated with your hardware key (in addition to the password).

Day-to-day use

At every login:

1. Enter your number and your password.
2. When the app asks for 2FA, insert your key or tap it via NFC.
3. Touch the button on the key.
4. You're logged in.

It's usually faster than looking up a code in an app: no need to open the authenticator app, no digits to retype.

Day to day:

• Keep your primary key with you (keychain, pocket).
• Store your backup key somewhere safe at home (locked drawer, safe).
• If you lose your primary key: use the backup key to log in, then remove the lost key in Profile → Security → 2FA.
• If you lose both keys: use a recovery code, then disable 2FA and set it up again.