3 ms·

What if they keys get lost/stolen or your house burns down. Do you keep a backup somewhere?

by rb808 7y ago

graton 7y ago
They mentioned having a handful of Yubikeys. The nice thing about U2F is that many providers support having multiple U2F tokens. For example Google, Github, and Gitlab do. Though others do not, for example AWS (last time I checked). So you can keep one or two on your keychain and keep others in different locations as backups. One nice thing about the Yubikeys is that they can also support TOTP like Google Authenticator. So you could store your authenticator token on both your phone and on the Yubikey. Then use the Yubikey Authenticator app to get the code from the Yubikey. I do recommend requiring touch to access the code from the Yubikey. You most likely need to setup this up at the same time on both your phone and Yubikey. As most authenticator apps (but not all) don't let you have access to the secret once stored on your phone.
- tzs 7y ago
  > The nice thing about U2F is that many providers support having multiple U2F tokens. For example Google, Github, and Gitlab do. Though others do not, for example AWS (last time I checked). Note that in the case of AWS it is not as bad as it seems, if you use your AWS account they way Amazon recommends. When you initially create your account, the credentials you make (email and password) have full privileges on the account. This is called the "root" user. The root user can create other users on the account, and delegate to them most of the privileges of root (but not all). Amazon recommends that you make one or more admin user accounts to wield all the privileges that can be delegated, and then no longer use the root account except for those few tasks that can only be done with root. Use the admin user(s) to create regular user accounts for everything else. If you have N U2F tokens, make N admin users and associate each with a different token. Associate each regular user account with one of the tokens you carry on your key chain. If you lose a token, use one of the remaining tokens with the admin account it is associated with to reset the accounts that were using the lost token and then associate them with one of the remaining tokens. If you use U2F with the root account and lose its token you can do a reset of your 2FA setup via email and phone. You should only rarely need to use the root account, so its token should probably be one of the ones you keep in some safe spot like in your fireproof safe, not one you carry around on your key chain.
- tialaramex 7y ago
  The WebAuthn (and presumably older U2F) spec explicitly tells implementers to allow multiple keys and the protocol is designed to make this work smoothly. I can kinda see AWS deciding your team administrator should take responsibility for enrolling new people etc. and so it's not necessary to support multiple keys but it means I don't enable it for my personal account, and I think it was a mistake to take this approach.

What if they keys get lost/stolen or your house burns down. Do you keep a backup somewhere?

by rb808 7y ago

What if they keys get lost/stolen or your house burns down. Do you keep a backup somewhere?

They mentioned having a handful of Yubikeys. The nice thing about U2F is that many providers support having multiple U2F tokens. For example Google, Github, and Gitlab do. Though others do not, for example AWS (last time I checked). So you can keep one or two on your keychain and keep others in different locations as backups. One nice thing about the Yubikeys is that they can also support TOTP like Google Authenticator. So you could store your authenticator token on both your phone and on the Yubikey. Then use the Yubikey Authenticator app to get the code from the Yubikey. I do recommend requiring touch to access the code from the Yubikey. You most likely need to setup this up at the same time on both your phone and Yubikey. As most authenticator apps (but not all) don't let you have access to the secret once stored on your phone.

tzs 7y ago
> The nice thing about U2F is that many providers support having multiple U2F tokens. For example Google, Github, and Gitlab do. Though others do not, for example AWS (last time I checked). Note that in the case of AWS it is not as bad as it seems, if you use your AWS account they way Amazon recommends. When you initially create your account, the credentials you make (email and password) have full privileges on the account. This is called the "root" user. The root user can create other users on the account, and delegate to them most of the privileges of root (but not all). Amazon recommends that you make one or more admin user accounts to wield all the privileges that can be delegated, and then no longer use the root account except for those few tasks that can only be done with root. Use the admin user(s) to create regular user accounts for everything else. If you have N U2F tokens, make N admin users and associate each with a different token. Associate each regular user account with one of the tokens you carry on your key chain. If you lose a token, use one of the remaining tokens with the admin account it is associated with to reset the accounts that were using the lost token and then associate them with one of the remaining tokens. If you use U2F with the root account and lose its token you can do a reset of your 2FA setup via email and phone. You should only rarely need to use the root account, so its token should probably be one of the ones you keep in some safe spot like in your fireproof safe, not one you carry around on your key chain.
tialaramex 7y ago
The WebAuthn (and presumably older U2F) spec explicitly tells implementers to allow multiple keys and the protocol is designed to make this work smoothly. I can kinda see AWS deciding your team administrator should take responsibility for enrolling new people etc. and so it's not necessary to support multiple keys but it means I don't enable it for my personal account, and I think it was a mistake to take this approach.