3 ms·

Let's do a mini Ask HN here in the comments. Is it a good idea for me to buy Yubikeys or Titan keys for my personal Google account? My wife's? My childrens'? W

by jpm_sd 4y ago

Let's do a mini Ask HN here in the comments. Is it a good idea for me to buy Yubikeys or Titan keys for my personal Google account? My wife's? My childrens'? Will that make it less likely, or more likely, that I eventually get arbitrarily locked out? These are accounts that we use on Windows PCs, Chromebooks, and Android phones. The keys would never leave the house. I think. I know the phones sorta fulfill this function already, but lost phone = big trouble, right?

alaricus 4y ago
I lost my phone on a business trip. It was a nightmare. Don't use your phone as a 2FA for everything. It creates a devastating single point of failure.
- stevemk14ebr 4y ago
  how is a physical yubikey any different from a loss POV?
  - alaricus 4y ago
    It's easier to keep multiple yubikeys than multiple phones. Also Google relying on Google for anything important/critical is a bad idea. The internet is full of people complaining that Google deactivated their account for no apparent reason.
  - philistine 4y ago
    There’s no difference, insofar as you might lose the Yubikey and not your phone. I guess I’d recommend enrolling both your phone and a Yubikey as a 2FA.
  - jagger27 4y ago
    It's not, and it's worse since there isn't a PIN or biometrics keeping it locked. Keep one in a safe for emergencies (like losing a phone) that can also unlock your accounts.
jagger27 4y ago
If you use FIDO keys as a backup second factor and keep them somewhere safe I'd argue that's strictly better than having a phone alone.
1970-01-01 4y ago
>Is it a good idea for me to buy Yubikeys or Titan keys for my personal Google account? My wife's? My childrens'? Will that make it less likely, or more likely, that I eventually get arbitrarily locked out? Yes. Buy the keys with at least one backup key. Treat the backup key(s) as 'critical data' and keep it in a fireproof safe or a safe deposit box. As you add more 2FA to existing accounts, you will need to periodically access this backup key and attach it to those accounts. It's extremely unlikely to be locked-out of your account if you authenticate with U2F key and password.
drivebycomment 4y ago
Highly recommended to get FIDO keys. Assuming you get multiple keys - and you can even share one physical key as a back up key across all family accounts, while each person has one personal key each - and register each phone as another fido key, and cross register parents keys with each other's, and for children's accounts. That way, every account will have at least 4 keys, with different physical exposure. The chance of lock out is basically 0 at that point. Added bonus is that security key auth don't need most of the heuristics based phishing or credential theft detection applied, as they are provably unphishable. So the sign-in is less likely to be subject to false positives of heuristics.

by jpm_sd 4y ago

alaricus 4y ago

I lost my phone on a business trip. It was a nightmare. Don't use your phone as a 2FA for everything. It creates a devastating single point of failure.

stevemk14ebr 4y ago
how is a physical yubikey any different from a loss POV?
- alaricus 4y ago
  It's easier to keep multiple yubikeys than multiple phones. Also Google relying on Google for anything important/critical is a bad idea. The internet is full of people complaining that Google deactivated their account for no apparent reason.
- philistine 4y ago
  There’s no difference, insofar as you might lose the Yubikey and not your phone. I guess I’d recommend enrolling both your phone and a Yubikey as a 2FA.
- jagger27 4y ago
  It's not, and it's worse since there isn't a PIN or biometrics keeping it locked. Keep one in a safe for emergencies (like losing a phone) that can also unlock your accounts.

jagger27 4y ago

If you use FIDO keys as a backup second factor and keep them somewhere safe I'd argue that's strictly better than having a phone alone.

1970-01-01 4y ago

>Is it a good idea for me to buy Yubikeys or Titan keys for my personal Google account? My wife's? My childrens'? Will that make it less likely, or more likely, that I eventually get arbitrarily locked out? Yes. Buy the keys with at least one backup key. Treat the backup key(s) as 'critical data' and keep it in a fireproof safe or a safe deposit box. As you add more 2FA to existing accounts, you will need to periodically access this backup key and attach it to those accounts. It's extremely unlikely to be locked-out of your account if you authenticate with U2F key and password.

drivebycomment 4y ago

Highly recommended to get FIDO keys. Assuming you get multiple keys - and you can even share one physical key as a back up key across all family accounts, while each person has one personal key each - and register each phone as another fido key, and cross register parents keys with each other's, and for children's accounts. That way, every account will have at least 4 keys, with different physical exposure. The chance of lock out is basically 0 at that point. Added bonus is that security key auth don't need most of the heuristics based phishing or credential theft detection applied, as they are provably unphishable. So the sign-in is less likely to be subject to false positives of heuristics.