5 ms·

I keep TOTP in my password manager, but my password manager is encrypted with a hardware key, a PIN code, and even getting the encrypted files depends on gettin

I keep TOTP in my password manager, but my password manager is encrypted with a hardware key, a PIN code, and even getting the encrypted files depends on getting into my private git server. I also only use TOTP on sites that don't support u2f/fido/webauthn or implement it badly (like amazon that only allows a single key).

k8sToGo 5y ago
What happens if you lose the hardware key? Is there a recovery mechanism?
- pebble 5y ago
  Standard practice is to have two if one breaks or is lost.
- SahAssar 5y ago
  I have multiple, both for that scenario and for different computers. I also have a USB stick with the root key for issuing new keys if all my hardware keys break.
daenz 5y ago
You can actually use multiple security keys on AWS I found out. It requires you to use the yubico authenticator app though. Essentially your security key stores the MFA secrets on it, and the yubico authenticator app accesses them for TOTP. You can register multiple keys in the authenticator app. So even though you can only have one MFA virtual device in AWS, that one virtual device is backed by multiple keys.
- SahAssar 5y ago
  Then you don't get the strong phising protection though. One of the reasons U2F/webauthn is great at phising protection is that the key verifies the sites domain. IIRC there has only been one good attack against that and even that required the user to allow webUSB for the phising site (and it has been patched).
  - daenz 5y ago
    True. I can't think of any good reason why AWS limits MFA to one device...seems like a very silly oversight to be honest.