3 ms·
What do you do in the event you lose your Yubikey?
by Yhippa 7y ago
What do you do in the event you lose your Yubikey?
- joshvm 7y agoYou hope that you have printed backup codes for whichever services provide it, or alternative auth, or you go through ID verification to regain access. Not much else you can do, the point of 2FA is that you can't get in without it. Some services let you store multiple keys. So you can own a separate yubikey that you keep in a trusted place eg deposit box.
- inetsee 7y agoYubikey recommends "having a backup device and registering both with your accounts". I vaguely remember some people saying that they have a backup Yubikey that they keep in their safe deposit box, so that it's as safe as possible.
- nicpottier 7y agoDoes anybody do this? I've read that as well but it doesn't make sense to me. How do I add my backup device if it is in a vault somewhere? For that to be useful I would have to have my backup device on me so I can add new accounts, but then that defeats the purpose. I could see this working for a few very secure logins, but if the idea is to two factor everything it doesn't seem tenable.
- deleted 7y ago[deleted]
- tmottabr 7y agoNo, your backup device need to be stored until you need it, not with you all times. you add your main device and your backup device. than you store the backyup device, after having it configured on your accounts, in the safe and use the main device to authenticate on a daily basis. when you create a new account you add your main device and than when possible retrieve the backup device from storage and add the new account to it and store it back again. on the event of you loosing your main device you retrieve the backup device from storage, use it to authenticate and remove your lost device from your accounts. You can then acquire a new one key, add to all your accounts and store the backup in a safe again until needed.
- timbit42 7y agoSafe deposit boxes aren't that safe.
- sho 7y agoCan't speak to the OP but I have multiple yubikeys. One I carry with me all the time, and at least one backup, which I keep somewhere safe. Most sites allow you to register multiple keys. Another approach is to have your phone as the daily 2FA device and the yubikey is the backup.
- deleted 7y ago[deleted]
- 1MachineElf 7y agoMultiple YubiKeys/FIDO authenticators. Registering them can be an issue. I haven't checked since last year, but the only website supporting them that allowed me to associate more than 1 to an account was Google.
- ozim 7y agoYou know you can have OTP on YubiKey and app on authenticator app on phone or laptop. Then you just connect your key to device and you are independent from a device.
- fredcy 7y agoI save each OTP config on three separate Yubikeys using Yubico Authenticator. I also screen-shot the QR code and save that and any recovery codes to a veracrypt volume. If the site allows for UTF I register each key for that too, but only if I can also use OTP since I can't yet use UTF with my android phone.
- fullstop 7y agoI have two of them. In the event that both are lost, I still have my recovery codes in a safe.
- stevehawk 7y agoHave more than one yubikey (I have one for home, one for work, and one in a safe deposit box)