11 ms·

Honest question, what happens when you lose one of these ?

fabian2k 8y ago
You should have backup 2FA methods for that case, either more tokens at different locations or other 2FA methods like TOTP or printed one-time backup codes or all of these together.
- lallysingh 8y ago
  I say take a morning and print out all your one-time recovery keys, put them in an envelope, and put that envelope next to your other important but rarely used documents.
  - saryant 8y ago
    Then buy a fireproof document safe and put all those documents in there.
    - zjs 8y ago
      Off topic: I feel like a fireproof document safe is something that I should own, but every time I shop for one I find myself going down a rabbit hole of unfamiliar terminology and certifications. As with many things, it seems like the marketing for such safes doesn't always match the fine print. (And sometime the fine print just seems impractical: I'm unlikely to actually air out my safe for 30 minutes each week, but could replace a desiccant a few times a year.) Does anyone have a recommendation for a safe that can protect paper documents and digital media from both fire and water in realistic conditions?
      - diggernet 8y ago
        I don't have a specific recommendation, but suggest you don't try to combine the paper and digital requirements. Look for UL fire endurance ratings. UL rates them on time and temperature. Edit: I've seen ratings up to 3 hours, but the longer the time, the bulkier and heavier for the same storage volume. For paper, you'd want something rated to stay below 350 degrees for at least an hour. That's not hard to find even in large sizes. I ended up with a used FireKing 4 drawer file cabinet from a company liquidation sale. Edit: Built like a tank, holds a lot, uses a Medeco key, weighs a couple hundred pounds empty. For digital, you need something rated to stay below 125 degrees. That's pretty hard to find, and usually only in very small boxes. Unfortunately, some companies (looking at you, Sentry) like to advertise "digital media" boxes which are not rated for 125 when you read the fine print. Not sure how they get away with that. :( I eventually found a small Sentry chest rated for 125 degrees for 30 minutes. Holds a couple hard drives and some DVDs. Sadly, do not recall the model number. Edit: Storage volume is maybe 5"x5"x8", walls are all 3-4" thick.
killaken2000 8y ago
I bought a yubikey 4 a while back and thought the same thing so I never really used it. I might use this as an excuse to buy another yubikey and have one as a backup.
kyrra 8y ago
For 2FA, having multiple of these or some kind of recovery code tends to be the answer, as you can remove the keys from sites you use it on. I am less willing to use something like this for passwordless logins. These types of devices should be part of the "something you have" part of 2FA, which should always be paired with a "something you know". Maybe I'm missing a step here, but why would you ever use this for passwordless?
- lugg 8y ago
  Because the something you know part isn't all that secure anyway? https://xkcd.com/538/ https://xkcd.com/538/
  - bluGill 8y ago
    it is a different level of security. The comic is fully correct, but you should still use a secret. That is why there are 3 different types of authentication. The first is something you have - a card or key. The second is something you know - a password. The third is something you are - a fingerprint. Each provides protection against a different attack and is vulnerable to different attacks. The more important the secret the more of them you should use. Note that you quickly get to the point where you need more than one person involved. You can compromise one person as much as you want, but if that person doesn't have the complete secret it doesn't do any good.
    - pps43 8y ago
      Calling a fingerprint "something you are" is a stretch. You are leaving fingerprints everywhere, they can be lifted from any smooth surface you touched (or even high-resolution photo) and then used to open biometric locks.
      - rikkus 8y ago
        The fingerprint belongs to you. Calling it 'something you are' is conveying this, without claim to it being somehow difficult to clone or entirely unique. Mother's maiden name is similar in this regard.
newscracker 8y ago
I’ve had the same concern for a long time, but more from a worry about what to do when it breaks or stops working after a few years. The recommendations I’ve read are to always have a recovery key or other alternate mechanisms that don’t depend on this device. One common suggestion also seems to be to print the recovery/alternate key and keep it safe. I believe this is a bigger barrier for common people who don’t know how to create and retain backup mechanisms. As such, I don’t see a lot of value in recommending these devices to those who aren’t tech savvy without also explaining to them about recovery. So much for technology!
mbeasley 8y ago
It's smart to buy two at the same time. While you can't copy a Yubikey, you can choose how to initialize them and you can initialize both identical to one another and then lock them down. That way they're copies of one another and fully backed up. I keep my main one on me at all times and have my backup in a safe place.
- teagee 8y ago
  Do you have a link to the docs that shows this? From what I can find on their site [1] it only supports a few of the protocols: -Static Password -HMAC-SHA1 Challenge-Response -OATH-TOTP (Yubico Authenticator) [1] https://support.yubico.com/support/solutions/articles/15000010242-duplicating-or-backing-up-a-yubikey https://support.yubico.com/support/solutions/articles/150000...
  - jwr 8y ago
    IMHO the YubiKey is not useful for any of those. It's excellent for storing OpenPGP keys and U2F, reasonably good for X.509 (as much as expected for X.509 I guess), and not good for much else. Using it for TOTP IMHO makes no sense, it's better to use your phone.
    - jfim 8y ago
      Using it for TOTP makes sense if you have more than one phone or want to use TOTP on your desktop through Yubico authenticator.
      - Boulth 8y ago
        Exactly. Additionally phones can be rooted and that exposes the underlying secret but Yubikeys are tamper resistant.
      - jdeibele 8y ago
        Authy is excellent for this. I've got it on my phone and tablet. I'm reluctant to use it on my desktop because I don't want to type in a huge password but I regard my 2015 MacBook as less secure than my devices that are protected by touch. You might be OK with that or have a laptop with touch ID.
Leace 8y ago
Yubikey has a lot of features (applets) built-in so the answer is "it depends on what you use". U2F? You need to have a second one or backup codes. OpenPGP? You probably have your subkeys backed up somewhere so you just order a new Yubikey and put your subkeys there. The same goes to PIV (X.509 certs). If you have some keys generated on the card, you need to provision your new Yubikey from the beginning.
- anilakar 8y ago
  How do you enroll a new U2F key to all the websites at once?
  - Snawoot 8y ago
    It's not possible, unfortunately. So you'll have to do it one by one.
    - Boulth 8y ago
      Yes, and it's by design. If you could then one random root key would be sufficient to "restore" all keys (as they are derived from that root key). U2F explicitly doesn't allow that given that the protocol has use counters.
baq 8y ago
same thing as when you lose one of your keys to the car: you use your backup key until you get a replacement primary. corollary to this is that you shouldn't ever get only one.
jwr 8y ago
I use the yubikey for OpenPGP (with SSH) and I took care to generate the keys on my computer then back them up appropriately. I can restore to any new yubikey quickly (tested). It's also easy to get two yubikeys and have a backup ready to use immediately. As to U2F, there is always a backup method (usually TOTP generated by Google Authenticator, and additionally recovery codes).
AdmiralAsshat 8y ago
I have a basic Yubikey (USB only) that I got from having an Ars Technica subscription. Right now I have that + Authy so that none of the critical services are Yubikey-only. If I get the new Yubikey, my plan is to put the old one in a safe as a backup.
specialp 8y ago
I actually have 2 Yubikeys, one with me, one in a safe place. But the price of these keeps rising. $50/$60 is starting to get a bit unreasonable for something that you were able to buy 2 or 3 of for the same price a few years back.
- xur17 8y ago
  I do the same thing, but my backup device is stored off-site, so it's pretty hard to make sure the backup device is connected to the same accounts as my primary ones. I currently keep a list of new accounts I've added and then periodically retrieve it and add the new accounts.
krrrh 8y ago
It’s worth knowing that krypton (https://krypt.co https://krypt.co) can make your smartphone act as a U2F or Fido2 (as well as SSH and PGP) device. You can use this instead of a Yubikey, as a backup, or just to inexpensively play with the concept and test out your backup protocols. Also, some cryptocurrency wallets, like Trezor and the Nano S, can do U2F. These can be effectively backed up to paper with 12 or 24 word seed phrases, and can serve as a good (if bulky) backup option. Still, save your backup codes for each site you register.
justinc8687 8y ago
I keep 3 keys active. One is on my keychain, one lives in a locked file cabinet in my home and I have one at my parents house on the other side of the country. I primarily use them for u2f and totp, though I want to deep dive into ssh via OpenPgp one of these days. When I want to add a new site, I: 1. Set it up on my keychain key. 2. If at home, set it up on my backup. If not, print out the totp secret on paper and when I get home, add it. 3. Call my parents and ask them to plug the 3rd key into a windows box I can Remote Desktop into and set up either totp or u2f via Remote Desktop. Once done, I ask them to unplug it (it’s attached to the desktop pc case with a lanyard). I find the “key at parents house” to be really helpful, as if I’m traveling and lose/destroy my keys, I can just call them and ask them to plug it in and then I’m back in business.

You should have backup 2FA methods for that case, either more tokens at different locations or other 2FA methods like TOTP or printed one-time backup codes or all of these together.

lallysingh 8y ago
I say take a morning and print out all your one-time recovery keys, put them in an envelope, and put that envelope next to your other important but rarely used documents.
- saryant 8y ago
  Then buy a fireproof document safe and put all those documents in there.
  - zjs 8y ago
    Off topic: I feel like a fireproof document safe is something that I should own, but every time I shop for one I find myself going down a rabbit hole of unfamiliar terminology and certifications. As with many things, it seems like the marketing for such safes doesn't always match the fine print. (And sometime the fine print just seems impractical: I'm unlikely to actually air out my safe for 30 minutes each week, but could replace a desiccant a few times a year.) Does anyone have a recommendation for a safe that can protect paper documents and digital media from both fire and water in realistic conditions?
    - diggernet 8y ago
      I don't have a specific recommendation, but suggest you don't try to combine the paper and digital requirements. Look for UL fire endurance ratings. UL rates them on time and temperature. Edit: I've seen ratings up to 3 hours, but the longer the time, the bulkier and heavier for the same storage volume. For paper, you'd want something rated to stay below 350 degrees for at least an hour. That's not hard to find even in large sizes. I ended up with a used FireKing 4 drawer file cabinet from a company liquidation sale. Edit: Built like a tank, holds a lot, uses a Medeco key, weighs a couple hundred pounds empty. For digital, you need something rated to stay below 125 degrees. That's pretty hard to find, and usually only in very small boxes. Unfortunately, some companies (looking at you, Sentry) like to advertise "digital media" boxes which are not rated for 125 when you read the fine print. Not sure how they get away with that. :( I eventually found a small Sentry chest rated for 125 degrees for 30 minutes. Holds a couple hard drives and some DVDs. Sadly, do not recall the model number. Edit: Storage volume is maybe 5"x5"x8", walls are all 3-4" thick.

killaken2000 8y ago

I bought a yubikey 4 a while back and thought the same thing so I never really used it. I might use this as an excuse to buy another yubikey and have one as a backup.

kyrra 8y ago

For 2FA, having multiple of these or some kind of recovery code tends to be the answer, as you can remove the keys from sites you use it on. I am less willing to use something like this for passwordless logins. These types of devices should be part of the "something you have" part of 2FA, which should always be paired with a "something you know". Maybe I'm missing a step here, but why would you ever use this for passwordless?

lugg 8y ago
Because the something you know part isn't all that secure anyway? https://xkcd.com/538/ https://xkcd.com/538/
- bluGill 8y ago
  it is a different level of security. The comic is fully correct, but you should still use a secret. That is why there are 3 different types of authentication. The first is something you have - a card or key. The second is something you know - a password. The third is something you are - a fingerprint. Each provides protection against a different attack and is vulnerable to different attacks. The more important the secret the more of them you should use. Note that you quickly get to the point where you need more than one person involved. You can compromise one person as much as you want, but if that person doesn't have the complete secret it doesn't do any good.
  - pps43 8y ago
    Calling a fingerprint "something you are" is a stretch. You are leaving fingerprints everywhere, they can be lifted from any smooth surface you touched (or even high-resolution photo) and then used to open biometric locks.
    - rikkus 8y ago
      The fingerprint belongs to you. Calling it 'something you are' is conveying this, without claim to it being somehow difficult to clone or entirely unique. Mother's maiden name is similar in this regard.

newscracker 8y ago

I’ve had the same concern for a long time, but more from a worry about what to do when it breaks or stops working after a few years. The recommendations I’ve read are to always have a recovery key or other alternate mechanisms that don’t depend on this device. One common suggestion also seems to be to print the recovery/alternate key and keep it safe. I believe this is a bigger barrier for common people who don’t know how to create and retain backup mechanisms. As such, I don’t see a lot of value in recommending these devices to those who aren’t tech savvy without also explaining to them about recovery. So much for technology!

mbeasley 8y ago

It's smart to buy two at the same time. While you can't copy a Yubikey, you can choose how to initialize them and you can initialize both identical to one another and then lock them down. That way they're copies of one another and fully backed up. I keep my main one on me at all times and have my backup in a safe place.

teagee 8y ago
Do you have a link to the docs that shows this? From what I can find on their site [1] it only supports a few of the protocols: -Static Password -HMAC-SHA1 Challenge-Response -OATH-TOTP (Yubico Authenticator) [1] https://support.yubico.com/support/solutions/articles/15000010242-duplicating-or-backing-up-a-yubikey https://support.yubico.com/support/solutions/articles/150000...
- jwr 8y ago
  IMHO the YubiKey is not useful for any of those. It's excellent for storing OpenPGP keys and U2F, reasonably good for X.509 (as much as expected for X.509 I guess), and not good for much else. Using it for TOTP IMHO makes no sense, it's better to use your phone.
  - jfim 8y ago
    Using it for TOTP makes sense if you have more than one phone or want to use TOTP on your desktop through Yubico authenticator.
    - Boulth 8y ago
      Exactly. Additionally phones can be rooted and that exposes the underlying secret but Yubikeys are tamper resistant.
    - jdeibele 8y ago
      Authy is excellent for this. I've got it on my phone and tablet. I'm reluctant to use it on my desktop because I don't want to type in a huge password but I regard my 2015 MacBook as less secure than my devices that are protected by touch. You might be OK with that or have a laptop with touch ID.

Leace 8y ago

Yubikey has a lot of features (applets) built-in so the answer is "it depends on what you use". U2F? You need to have a second one or backup codes. OpenPGP? You probably have your subkeys backed up somewhere so you just order a new Yubikey and put your subkeys there. The same goes to PIV (X.509 certs). If you have some keys generated on the card, you need to provision your new Yubikey from the beginning.

anilakar 8y ago
How do you enroll a new U2F key to all the websites at once?
- Snawoot 8y ago
  It's not possible, unfortunately. So you'll have to do it one by one.
  - Boulth 8y ago
    Yes, and it's by design. If you could then one random root key would be sufficient to "restore" all keys (as they are derived from that root key). U2F explicitly doesn't allow that given that the protocol has use counters.

baq 8y ago

same thing as when you lose one of your keys to the car: you use your backup key until you get a replacement primary. corollary to this is that you shouldn't ever get only one.

jwr 8y ago

I use the yubikey for OpenPGP (with SSH) and I took care to generate the keys on my computer then back them up appropriately. I can restore to any new yubikey quickly (tested). It's also easy to get two yubikeys and have a backup ready to use immediately. As to U2F, there is always a backup method (usually TOTP generated by Google Authenticator, and additionally recovery codes).

AdmiralAsshat 8y ago

I have a basic Yubikey (USB only) that I got from having an Ars Technica subscription. Right now I have that + Authy so that none of the critical services are Yubikey-only. If I get the new Yubikey, my plan is to put the old one in a safe as a backup.

specialp 8y ago

I actually have 2 Yubikeys, one with me, one in a safe place. But the price of these keeps rising. $50/$60 is starting to get a bit unreasonable for something that you were able to buy 2 or 3 of for the same price a few years back.

xur17 8y ago
I do the same thing, but my backup device is stored off-site, so it's pretty hard to make sure the backup device is connected to the same accounts as my primary ones. I currently keep a list of new accounts I've added and then periodically retrieve it and add the new accounts.

krrrh 8y ago

It’s worth knowing that krypton (https://krypt.co https://krypt.co) can make your smartphone act as a U2F or Fido2 (as well as SSH and PGP) device. You can use this instead of a Yubikey, as a backup, or just to inexpensively play with the concept and test out your backup protocols. Also, some cryptocurrency wallets, like Trezor and the Nano S, can do U2F. These can be effectively backed up to paper with 12 or 24 word seed phrases, and can serve as a good (if bulky) backup option. Still, save your backup codes for each site you register.

justinc8687 8y ago

I keep 3 keys active. One is on my keychain, one lives in a locked file cabinet in my home and I have one at my parents house on the other side of the country. I primarily use them for u2f and totp, though I want to deep dive into ssh via OpenPgp one of these days. When I want to add a new site, I: 1. Set it up on my keychain key. 2. If at home, set it up on my backup. If not, print out the totp secret on paper and when I get home, add it. 3. Call my parents and ask them to plug the 3rd key into a windows box I can Remote Desktop into and set up either totp or u2f via Remote Desktop. Once done, I ask them to unplug it (it’s attached to the desktop pc case with a lanyard). I find the “key at parents house” to be really helpful, as if I’m traveling and lose/destroy my keys, I can just call them and ask them to plug it in and then I’m back in business.