4 ms·
Yes, on mobile you either plug the YubiKey into your devices USB-C (or lightning) port, or tap the YubiKey to your phone. The totp secrets live on the yubikey a
by RockRobotRock 4y ago
Yes, on mobile you either plug the YubiKey into your devices USB-C (or lightning) port, or tap the YubiKey to your phone. The totp secrets live on the yubikey and can't be extracted. You can only read out the current code. I believe you can also secure your YubiKey with a password so it must be entered to see the codes.
If you wish to have the same TOTPs on multiple YubiKeys, you are recommended to take a screenshot of the QR code you're given at the beginning (which contains the secret key), and manually add it to all the backup keys you prefer, and then securely erase the screenshot.
further reading: https://support.yubico.com/hc/en-us/articles/360013789259-Using-Your-YubiKey-with-Authenticator-Codes https://support.yubico.com/hc/en-us/articles/360013789259-Us...
- smeej 4y agoIt's worth noting that if you install Yubico Authenticator on another device and use the same key, you do have access to the codes, because as you said, they're stored on the key. I initially thought the codes were stored on my phone and the key was only required for access, but that's not the case. That's either a benefit or a drawback, depending on your threat model, but it's definitely something people should understand.
- croes 4y agoWhat happens if the Yubikey gets damaged?
- Semaphor 4y agoThat’s why (as with essentially all YubiKey use-cases), you have backup(s).