3 ms·
I'd be more concerned about general reliability. How long will these last? Because I think they should last at a minimum 10 years. If you only use one for an ac
by mtgx 8y ago
I'd be more concerned about general reliability. How long will these last? Because I think they should last at a minimum 10 years. If you only use one for an account, and it breaks on you, you're screwed.
So I would use at least 2, but hopefully websites will allow this, and that will probably be the largest bottleneck in the future. I couldn't care less about "SMS backups" or such nonsense, as that completely defeats the point of using a hardware token. Your account will only be as secure as your phone number is.
- zjs 8y agoI configure a second YubiKey as a backup, and disabled SMS-based recovery where possible. Many sites allow this explicitly, and will let you view details about the last time each key was used to log in. Some sites that use TOTP only allow for one "authenticator" to be configured. In those cases, I scan the same QR code into each key. This process requires you to retrieve your backup key from whatever safe place you store it in when configuring 2FA on new accounts, but that feels like a reasonable trade-off; I don't make new accounts very often, and when I do I can wait to configure 2FA until I have access to my backup key.
- emlun 8y agoMy friend lost his YubiKey and found it embedded in his gravel driveway six months later. Still worked like nothing had happened.