5 ms·

Yubikeys store everything on the key. I can lose my phone and use your phone to see my 2FA codes. It's honestly one of the only way MFA make sense - otherwise y

by pluc 4y ago

Yubikeys store everything on the key. I can lose my phone and use your phone to see my 2FA codes. It's honestly one of the only way MFA make sense - otherwise you lock yourself out of your entire digital life when you lose your phone and need to rely on storing your backup codes (which opens up a storage security wormhole). It's also a lot easier to wear around your neck.

SoftTalker 4y ago
So you've moved the worry from losing/breaking your phone to losing/breaking your YubiKey?
- pluc 4y ago
  Sure. I have a backup key but yes, you can't get MFA without adding a device that you may lose; whether that's your phone or a key. Like I said I prefer a key because I can't put my phone on a chain around my neck or on my keychain.
- hospadar 4y ago
  I keep a second key as backup for this reason, which honestly is overkill and I only do because I got a second one for free at a conference. Easier solution (which I also use in case I someday need the second one only to discover that the blue smoke leaked out) is to just print out the TOTP secrets and keep them somewhere. I'm usually printing out recovery codes when I get a new TOTP secret so this has never felt like a big deal. Also easy enough to maintain a keepass[xc] vault for totp secrets, you could keep a separate one from your passwords if you were feeling paranoid. Great support on mobile and desktop for using a keepass db as a TOTP source - and easy to sync with dropbox/email/ssh/your web server/whatever
  - jve 4y ago
    Everyone should read this risk mitigation solution for loosing 2FA. I always think about printing recovery codes, but having keepass vault with those codes also sounds great. You may even have some random password there and store it printed out in some locations just for emergency. Anyways, people should think about these risks when dealing with 2FA: flood, fire, stolen, lost, (I) broke (Smartphone, yubikey, usb, etc), broke (itself), software bug, kids, washing machines, etc.
    - ngrilly 4y ago
      And also something we usually don’t consider: loss of memory, which can occur in combination with a traumatic event like your house burning. Then you can loose your smartphone, your Yubikey, your printed copy, and your memory all at the same time if everything is stored in one place. And this is exactly when you will need those the most. Not easy to defend against such a nightmarish scenario.
- dathinab 4y ago
  who says you only have one or no other backup? anyway I wouldn't but s Yubikey for TOTP. OTP sucks. Sure it's better than no 2FA and TOTP is better than SMS OTP still it's not grate. WebAuthn-like auth can provide all the benefits of TOTP while being way more secure and in some cases even not convenient. The main drawback is how to backup your 2FA which makes it less of a choice for a "casual" user.
openplatypus 4y ago
The only downside is limited space on Yubikey. I am currently carrying 2 tokens :(
- pgalvin 4y ago
  Up to 32, for those reading who (like me) didn’t know about this limitation. https://support.yubico.com/hc/en-us/articles/4404456942738-FAQ https://support.yubico.com/hc/en-us/articles/4404456942738-F...
  - psychlops 4y ago
    Good luck finding 32 places that accept Yubikey.
    - stavros 4y ago
      They don't have to accept Yubikey, they have to accept TOTP. Which ~everything does.
      - nuker 4y ago
        except eBay
        graftak 4y ago
        Or Google, very user hostile because it makes me choose between giving them my phone number or installing their spyware app on my phone.
        pluc 4y ago
        I use Yubikey USB to authenticate with Google.
        seized 4y ago
        Google's authenticator is just a standard TOTP app. You can use any app, including Aegis.
eitland 4y ago
My Yubikey always loses its credentials. (If anyone else knows about it and have a fix I'm all ears.) I guess I need a new one, but what I want to say is don't rely on a single Yubikey or even two. Do have backups.
- zmxz 4y ago
  Which model do you own and how does the loss manifest? The single-tap and long-tap don't produce expected output? Can you share more info on it? I own many Yubikeys (due to research I've been doing in 2017.) and I had many Yubikeys to play with, for TOTP/HOTP/U2F purposes, even using it to unlock Windows and I haven't had a case of a Yubikey basically deprogram itself. I washed them in the washing machine, ran them over with my car, thew them in mud piles and they always worked without a fault so your case is a surprising one. Judging by what you wrote, unless there's some weird NFC communication going on between your phone and Yubikey (are they in proximity?), I'd say it's faulty and you need a new one.
  - eitland 4y ago
    Classic USB. Plastic. (I don't know the exact model, I got it from work.) After adding a site or a computer it works a few days and then suddenly when I try to use it with my phone or computer I just get an error about no <something>. So yes, probably defective.
    - zmxz 4y ago
      Not enough info to even guess what might be wrong, but I'd assume it's defective and I'd try with another key as well. I wish you good luck with the next Yubkey you get! :) Btw. this is the first time I've read on a public forum that someones Yubikey is defective, they are really well made and I didn't manage to break one via regular use and bad maintenance.

by pluc 4y ago

SoftTalker 4y ago

So you've moved the worry from losing/breaking your phone to losing/breaking your YubiKey?

pluc 4y ago
Sure. I have a backup key but yes, you can't get MFA without adding a device that you may lose; whether that's your phone or a key. Like I said I prefer a key because I can't put my phone on a chain around my neck or on my keychain.
hospadar 4y ago
I keep a second key as backup for this reason, which honestly is overkill and I only do because I got a second one for free at a conference. Easier solution (which I also use in case I someday need the second one only to discover that the blue smoke leaked out) is to just print out the TOTP secrets and keep them somewhere. I'm usually printing out recovery codes when I get a new TOTP secret so this has never felt like a big deal. Also easy enough to maintain a keepass[xc] vault for totp secrets, you could keep a separate one from your passwords if you were feeling paranoid. Great support on mobile and desktop for using a keepass db as a TOTP source - and easy to sync with dropbox/email/ssh/your web server/whatever
- jve 4y ago
  Everyone should read this risk mitigation solution for loosing 2FA. I always think about printing recovery codes, but having keepass vault with those codes also sounds great. You may even have some random password there and store it printed out in some locations just for emergency. Anyways, people should think about these risks when dealing with 2FA: flood, fire, stolen, lost, (I) broke (Smartphone, yubikey, usb, etc), broke (itself), software bug, kids, washing machines, etc.
  - ngrilly 4y ago
    And also something we usually don’t consider: loss of memory, which can occur in combination with a traumatic event like your house burning. Then you can loose your smartphone, your Yubikey, your printed copy, and your memory all at the same time if everything is stored in one place. And this is exactly when you will need those the most. Not easy to defend against such a nightmarish scenario.
dathinab 4y ago
who says you only have one or no other backup? anyway I wouldn't but s Yubikey for TOTP. OTP sucks. Sure it's better than no 2FA and TOTP is better than SMS OTP still it's not grate. WebAuthn-like auth can provide all the benefits of TOTP while being way more secure and in some cases even not convenient. The main drawback is how to backup your 2FA which makes it less of a choice for a "casual" user.

openplatypus 4y ago

The only downside is limited space on Yubikey. I am currently carrying 2 tokens :(

pgalvin 4y ago
Up to 32, for those reading who (like me) didn’t know about this limitation. https://support.yubico.com/hc/en-us/articles/4404456942738-FAQ https://support.yubico.com/hc/en-us/articles/4404456942738-F...
- psychlops 4y ago
  Good luck finding 32 places that accept Yubikey.
  - stavros 4y ago
    They don't have to accept Yubikey, they have to accept TOTP. Which ~everything does.
    - nuker 4y ago
      except eBay
      - graftak 4y ago
        Or Google, very user hostile because it makes me choose between giving them my phone number or installing their spyware app on my phone.
        pluc 4y ago
        I use Yubikey USB to authenticate with Google.
        seized 4y ago
        Google's authenticator is just a standard TOTP app. You can use any app, including Aegis.

eitland 4y ago

My Yubikey always loses its credentials. (If anyone else knows about it and have a fix I'm all ears.) I guess I need a new one, but what I want to say is don't rely on a single Yubikey or even two. Do have backups.

zmxz 4y ago
Which model do you own and how does the loss manifest? The single-tap and long-tap don't produce expected output? Can you share more info on it? I own many Yubikeys (due to research I've been doing in 2017.) and I had many Yubikeys to play with, for TOTP/HOTP/U2F purposes, even using it to unlock Windows and I haven't had a case of a Yubikey basically deprogram itself. I washed them in the washing machine, ran them over with my car, thew them in mud piles and they always worked without a fault so your case is a surprising one. Judging by what you wrote, unless there's some weird NFC communication going on between your phone and Yubikey (are they in proximity?), I'd say it's faulty and you need a new one.
- eitland 4y ago
  Classic USB. Plastic. (I don't know the exact model, I got it from work.) After adding a site or a computer it works a few days and then suddenly when I try to use it with my phone or computer I just get an error about no <something>. So yes, probably defective.
  - zmxz 4y ago
    Not enough info to even guess what might be wrong, but I'd assume it's defective and I'd try with another key as well. I wish you good luck with the next Yubkey you get! :) Btw. this is the first time I've read on a public forum that someones Yubikey is defective, they are really well made and I didn't manage to break one via regular use and bad maintenance.