6 ms·

If my Yubikey gets stolen, how do I log in into my accounts? Serious question; never understood how that works.

by fjiizrsdfjjj 6y ago

proactivesvcs 6y ago
The last time I've used the configurators on Windows and Linux they provide the private key material for one to backup.
ahmedalsudani 6y ago
That’s how 2FA works. It’s a physical token. You either have other 2FA devices or backup codes.
corty 6y ago
Depends. Some have a bunch of magic numbers you can use as alternative "second factor", basically another password for the special purpose of bypassing a real 2nd factor. That's of course stupid and dangerous. Then there are those where you can register another 2nd factor, e.g. another Fido-Key, SMS-Codes or recovery email. Those might be better or might be worse, depending on the method and circumstances. E.g. SMS is vulnerable to all kinds of SIM-Cloning and redirection stuff, email is vulnerable to whatever your email might be vulnerable to. The only thing I would accept as really idiot-proof and secure is "go someplace, show a government-issued hard-to-fake ID" (like a passport, not your drivers license...) like banks do. But that only works with physically present businesses and accounts that are strictly tied to one person. And even there, "Joe Smith" might impersonate "Joe Smith"...
wyager 6y ago
I have a backup U2F device. You can register multiple with any account. If I somehow manage to lose both, I assume I’ll have to talk to a customer support rep or something.
- growse 6y ago
  This depends on the service supporting it though, and not all of them do (e.g. AWS).
scott00 6y ago
Some other responders have given you the answer as it currently exists. They are all either inconvenient, weaken security, or both. For that reason, I would only suggest using a security key for a small number of critical services, where it's worth the extra effort to deal with the backup mechanisms. However, a good solution for this issue is finally in the works: https://www.yubico.com/blog/yubico-proposes-webauthn-protocol-extension-to-simplify-backup-security-keys/ https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...
- cbsmith 6y ago
  Having two keys, one of which you keep in a secure place, seems pretty simple and intuitive to me.
  - scott00 6y ago
    What does your workflow look like when you set up new credentials?
    - andrewnicolalde 6y ago
      If you mean when registering for a new account, annoyingly you need to physically have each key with you to register it with a new service. Biggest flaw in the spec IMO.
    - cbsmith 6y ago
      You need both of the devices when you set it up. That is one thing they are working on fixing, and is easily the biggest hassle of the whole thing.
      - scott00 6y ago
        If creating new accounts only when you are at the secure location where your backup key lives works for you that's great, but I suspect that most people in that situation would do one or more of the following: (1) Store their backup key in a more convenient, but less secure location (likely their home), putting them at risk of losing both the primary and backup key to the same event. (2) Enroll only their primary key when an account is created, putting them at risk of locking themself out if they forget to add the backup at some point. (3) Only use security keys for the highest value accounts, which tend to be a small enough number that you have a chance of actually remembering to add the backup key every time you set one up. Of these, #3 is the only one that doesn't pose what I consider an unacceptable risk of lockout to the average person, so that's what I recommend.
taeric 6y ago
This is akin to asking how do you start your car if you lose your keys? Enter your house? You have backups or other recourse to get things rekeyed.
mwarkentin 6y ago
This was confusing to me until I realized a couple of things: - you can still have TOTP enabled on the site as a backup 2FA method - you can configure multiple yubi keys for a single site - so I have one on my keychain that does NFC + USB-C for my MBP, and another “Nano” key that is left in my home imac - they are both registered with most of the sites I’ve configured If my keychain is lost/stolen then I can still login from home or with my TOTP code as a fallback.
andrewnicolalde 6y ago
Second yubikey ;)

If my Yubikey gets stolen, how do I log in into my accounts? Serious question; never understood how that works.

proactivesvcs 6y ago

The last time I've used the configurators on Windows and Linux they provide the private key material for one to backup.

ahmedalsudani 6y ago

That’s how 2FA works. It’s a physical token. You either have other 2FA devices or backup codes.

corty 6y ago

Depends. Some have a bunch of magic numbers you can use as alternative "second factor", basically another password for the special purpose of bypassing a real 2nd factor. That's of course stupid and dangerous. Then there are those where you can register another 2nd factor, e.g. another Fido-Key, SMS-Codes or recovery email. Those might be better or might be worse, depending on the method and circumstances. E.g. SMS is vulnerable to all kinds of SIM-Cloning and redirection stuff, email is vulnerable to whatever your email might be vulnerable to. The only thing I would accept as really idiot-proof and secure is "go someplace, show a government-issued hard-to-fake ID" (like a passport, not your drivers license...) like banks do. But that only works with physically present businesses and accounts that are strictly tied to one person. And even there, "Joe Smith" might impersonate "Joe Smith"...

wyager 6y ago

I have a backup U2F device. You can register multiple with any account. If I somehow manage to lose both, I assume I’ll have to talk to a customer support rep or something.

growse 6y ago
This depends on the service supporting it though, and not all of them do (e.g. AWS).

scott00 6y ago

Some other responders have given you the answer as it currently exists. They are all either inconvenient, weaken security, or both. For that reason, I would only suggest using a security key for a small number of critical services, where it's worth the extra effort to deal with the backup mechanisms. However, a good solution for this issue is finally in the works: https://www.yubico.com/blog/yubico-proposes-webauthn-protocol-extension-to-simplify-backup-security-keys/ https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...

cbsmith 6y ago
Having two keys, one of which you keep in a secure place, seems pretty simple and intuitive to me.
- scott00 6y ago
  What does your workflow look like when you set up new credentials?
  - andrewnicolalde 6y ago
    If you mean when registering for a new account, annoyingly you need to physically have each key with you to register it with a new service. Biggest flaw in the spec IMO.
  - cbsmith 6y ago
    You need both of the devices when you set it up. That is one thing they are working on fixing, and is easily the biggest hassle of the whole thing.
    - scott00 6y ago
      If creating new accounts only when you are at the secure location where your backup key lives works for you that's great, but I suspect that most people in that situation would do one or more of the following: (1) Store their backup key in a more convenient, but less secure location (likely their home), putting them at risk of losing both the primary and backup key to the same event. (2) Enroll only their primary key when an account is created, putting them at risk of locking themself out if they forget to add the backup at some point. (3) Only use security keys for the highest value accounts, which tend to be a small enough number that you have a chance of actually remembering to add the backup key every time you set one up. Of these, #3 is the only one that doesn't pose what I consider an unacceptable risk of lockout to the average person, so that's what I recommend.

taeric 6y ago

This is akin to asking how do you start your car if you lose your keys? Enter your house? You have backups or other recourse to get things rekeyed.

mwarkentin 6y ago

This was confusing to me until I realized a couple of things: - you can still have TOTP enabled on the site as a backup 2FA method - you can configure multiple yubi keys for a single site - so I have one on my keychain that does NFC + USB-C for my MBP, and another “Nano” key that is left in my home imac - they are both registered with most of the sites I’ve configured If my keychain is lost/stolen then I can still login from home or with my TOTP code as a fallback.

andrewnicolalde 6y ago

Second yubikey ;)