4 ms·
Buy 3 keys. Register all of them to your account. Then register all of them to your spouses account too. Put one on your keychain. Put one on your spouses keych
by sly010 5y ago
Buy 3 keys. Register all of them to your account.
Then register all of them to your spouses account too.
Put one on your keychain. Put one on your spouses keychain. Put one in a safe place.
By enrolling my spouse and cross registering all keys, both of us are safe. We might loose our keychain, but we will always find each other, even when we are traveling.
This works for Google and GitHub, but not every service allows for multiple keys. But this should be a no-brainer imho.
- BoppreH 5y agoDoesn't that mean that stealing any of the 3 yubikeys means full permanent compromise of all your and your spouse's account? I think a good with system should include some sort of revocation, like a master key you can keep in a safe to revoke other devices.
- 1MachineElf 5y agoNo, it does not mean that. At least in my experience, every service where I have multiple YubiKeys registered still requires my username and password. Without those, someone who stole the YubiKey would not be able to login to my accounts.
- cronos 5y agoYou can un-register any of the keys when you're logged in. So if you lose one key, log in using the others and remove it. No need for a master key.
- BoppreH 5y agoYour idea works well for recovery. But I'm thinking of a revocation scenario, where a key is stolen. In that case the attacker can just remove your keys first.
- jackson1442 5y agoYubikey still acts as a second factor, so for the average person's threat model this should be fine provided you use strong, unique passwords for your accounts (i.e. a password manager). 1Password supports U2F as a second factor to access your account, but you still need to know your secret key and master password; you cannot decrypt your vault with only a hardware token.
- sammorrowdrums 5y agoSo, the "something you have" element of security is to primarily avoid remote compromise. And even make local compromise require an additional theft step. If the hacker gets your key, and your password it's game over. But hacking the password will take some time hopefully, and systems usually have retry limits etc. so if you discover your lost key, you hopefully have some time to revoke the lost key. I personally would not use it for password-less login, as it is only good as a second factor. If your threat model includes any real likelihood of people capable of stealing your keys and cracking your passwords, then 2FA is only a small part of the opsec you need. Things like NSA's Zero Trust Security model comes to mind https://news.ycombinator.com/item?id=26549363 https://news.ycombinator.com/item?id=26549363 If you're at that level, you probably need specialist infra. But potential compromises don't mean you're not less secure than before, Yubikey would still make you more difficult to hack.
- girvo 5y agoThey need my password too, so they’ll have to have cracked my 1Password account as well. My third key is indeed in a safe, but it’s not special in any way.
- sly010 5y agoThe 2 in U2F stands for second factor, these devices are useless on their own.
- thatnerdyguy 5y agoThat's all well and good, but a few weeks later I have another service I'm going to sign up for... I have to... first go to my safe deposit box to grab my third key? If I don't, then seems like it's a lot of bookkeeping.
- pvg 5y agoYou don't need to make it as elaborate as 'safe deposit box' or 'implanted into spouse' and most accounts that matter have other ways of recovery, e.g. an app-based authenticator, one-time recovery codes (a recovery code is something you might want to stick in a safe deposit box). You can just get, say, three hw keys, put one on a keychain another somewhere on your desk and a third in a drawer somewhere.
- deleted 5y ago[deleted]