3 ms·
What's the deal with lost yubikey user workflow? Rely on individual websites to give you a one-time recovery passcode that you then have to input into every web
by ahelwer 8y ago
What's the deal with lost yubikey user workflow? Rely on individual websites to give you a one-time recovery passcode that you then have to input into every website? I can't believe I'm taking UX cues from cryptocurrencies, but what about providing the user with a seed for the yubikey private key they can back-up offline then reinstall in a new yubikey?
P.S. just ordered a yubikey security key, excited to add this additional layer to my own personal byzantine security labyrinth. Or maybe simplify it, who knows!
- closeparen 8y agoRecovery codes or 2 Yubikeys.
- krrrh 8y agoYou can use Trezor or Ledger hardware wallets for U2F with recoverable seed words. Even if you go with a Yubikey, which has a better form factor, one of these is a pretty good backup device since they can be further backed up to paper.
- girvo 8y agoI bought two Yubikeys and have one in a safe (mainly so I don’t lose it). This isn’t perfect though, as not all places support multiple keys :(
- emlun 8y agoIt's still a largely unsolved problem, unfortunately. Enabling private key backup comes with a suite of nasty problems like what it means for device attestation and how to guarantee that a key hasn't been cloned in transit. Our best recommendation right now is to have a backup key, but it still means you have to register it everywhere in advance and then go to each site to revoke the lost key. At least Web Authentication platform credentials should let you have multiple authenticators without having to buy an extra YubiKey.