6 ms·

The way two factor auth works is that you register your hardware key and you also get 10 one-time-usage recovery codes which you can use instead. So, if you lo

The way two factor auth works is that you register your hardware key and you also get 10 one-time-usage recovery codes which you can use instead. So, if you lose your YubiKey, you can still login 10 times using a recovery code. Presumably during those 10 times you either disable 2FA or register a new YubiKey.

fauigerzigerk 7y ago
All depending on the discretion of the various services. Of all the services that force me to use 2FA only a tiny minority provides recovery codes.
- idlewords 7y ago
  What services allow U2F security keys but don't provide single-use recovery codes as backup?
  - fauigerzigerk 7y ago
    I don't know about U2F specifically, but recovery codes are not generally a feature of 2FA. Edit: And let me just add why I think this is relevant. Even though few people have dedicated hardware keys today, many 2FA schemes depend on being in possession of a particular phone. There are typically no backups and no recovery codes. I don't think this would necessarily change if specialised key hardware was used more often. In fact, my business bank account and a broker I previously used both require hardware keys and do not provide recovery codes.
    - fierarul 7y ago
      I assume your bank has a physical place you can go to in order to get another token and you have a proper business relationship with them and somebody will ID you. But many other sites have no other alternatives to recover so the recovery codes are a nice solution. Note that I dislike that my bank gives me their specific hardware token. I am not sure why I couldn't use a 'standard' Yubikey instead.
91iejrj20310 7y ago
I guess those recovery codes are the new security questions - yes theoretically they are there to recover your account, but in practice, you won't have them at hand unless you stored them in your password manager.
- prophesi 7y ago
  It's still a little better than security questions in that the layman's recovery codes won't be publicly available or easily guessable personal information.
- fierarul 7y ago
  The whole idea of having a hardware token is to separate what's at hand. Having the recovery codes in the password manager seems like a bad idea. Google recommends printing them.
  - LaGrange 7y ago
    ...oh yes, having your passwords printed out is such a great improvement. Considering how likely the "hacker" is to be a person sharing your household, you might as well put them on a post-it note and stick them to the screen. Recovery codes go straight into the password manager, right next to my mother's maiden name, ASuTeil7quoongak2aeniVar.
    - fierarul 7y ago
      Nonsense, the household hacker can also find your YubiKey. Much easier than a single piece of paper.
      - LaGrange 7y ago
        ...there are other 2fa methods that don't disable at least one "personal" factors, whether that's a password or using finger/face/whatever. Not that great against cops, but stands a chance against many abusers, recent exes and terrible flatmates. And the yubikey is, theoretically, worn on you. Are you going to carry around all the printouts?

fauigerzigerk 7y ago

All depending on the discretion of the various services. Of all the services that force me to use 2FA only a tiny minority provides recovery codes.

idlewords 7y ago
What services allow U2F security keys but don't provide single-use recovery codes as backup?
- fauigerzigerk 7y ago
  I don't know about U2F specifically, but recovery codes are not generally a feature of 2FA. Edit: And let me just add why I think this is relevant. Even though few people have dedicated hardware keys today, many 2FA schemes depend on being in possession of a particular phone. There are typically no backups and no recovery codes. I don't think this would necessarily change if specialised key hardware was used more often. In fact, my business bank account and a broker I previously used both require hardware keys and do not provide recovery codes.
  - fierarul 7y ago
    I assume your bank has a physical place you can go to in order to get another token and you have a proper business relationship with them and somebody will ID you. But many other sites have no other alternatives to recover so the recovery codes are a nice solution. Note that I dislike that my bank gives me their specific hardware token. I am not sure why I couldn't use a 'standard' Yubikey instead.

91iejrj20310 7y ago

I guess those recovery codes are the new security questions - yes theoretically they are there to recover your account, but in practice, you won't have them at hand unless you stored them in your password manager.

prophesi 7y ago
It's still a little better than security questions in that the layman's recovery codes won't be publicly available or easily guessable personal information.
fierarul 7y ago
The whole idea of having a hardware token is to separate what's at hand. Having the recovery codes in the password manager seems like a bad idea. Google recommends printing them.
- LaGrange 7y ago
  ...oh yes, having your passwords printed out is such a great improvement. Considering how likely the "hacker" is to be a person sharing your household, you might as well put them on a post-it note and stick them to the screen. Recovery codes go straight into the password manager, right next to my mother's maiden name, ASuTeil7quoongak2aeniVar.
  - fierarul 7y ago
    Nonsense, the household hacker can also find your YubiKey. Much easier than a single piece of paper.
    - LaGrange 7y ago
      ...there are other 2fa methods that don't disable at least one "personal" factors, whether that's a password or using finger/face/whatever. Not that great against cops, but stands a chance against many abusers, recent exes and terrible flatmates. And the yubikey is, theoretically, worn on you. Are you going to carry around all the printouts?