4 ms·
I have 2 yubikeys and always register them both. So if one is lost or broken then I still have another to log into sites. As for theft, if you’re using your yu
by goodoldneon 4y ago
I have 2 yubikeys and always register them both. So if one is lost or broken then I still have another to log into sites.
As for theft, if you’re using your yubikey as a 2nd factor then they still can’t log in because they don’t know your password. If you’re using your yubikey as both factors then it either has a PIN or biometrics, so the thief can’t log in.
My main use for my yubikey is for SSH. I have PIN-protected SSH with a private key that can’t be exfiltrated
- illiac786 4y agoBut if you register both every time, it means you always carry both yubikeys with you, right? I hope you don’t have both on the same keyring, but if you carry both around, the resilience/redundancy of that setup is lacking in my view.
- neatze 4y agosudo, screen lock, luks, ssh, pgp, weblogins, keepass are all setup with yubikeys. I wish I could generate my own private fido key in similar way as pgp.
- account-5 4y agoThis is what I would require before migrating. Opensource local only Fido key generation. But like I said in the comment below, I suspect these vendors are only here for vendor lock-in and targeted advertising. And the websites enabling webauthn are likely to require you to use a vendors app/service. Like banking sites today not allowing me to utilise keepassxc totp functionality trying to force me to download their app or SMS.
- vladvasiliu 4y agoYes, I think it would be great to be able to create the key otuside of the physical hardware token, just like you can do with the GPG applet on the Yubkey. Store the original on some offline, encrypted media, ideally in multiple places. This way, you don't need to have two yubikeys on hand and register them both on every new site. But in case you lose, it's not impossible to create a new one. Yet, obtaining the key from the hardware token shouldn't be any more possible than with the current system.
- Godel_unicode 4y agoThese two goals are mutually exclusive. If you let people generate their own key material outside the enclave, people will be emailing it to themselves just in case.
- ilyt 4y agoWell, non-stupid people also use yubikeys, so they are not mutually exclusive
- Godel_unicode 4y agoMaybe, but there are also a lot of people who don’t understand the point of yubikeys that want to use them but export the secrets. Those people cannot be trusted with their own security and need to be protected from themselves.
- ilyt 4y agoNope, let them be burned, the sooner the better, before they own something actually valuable behind the account
- Godel_unicode 4y agoWhat a truly psychopathic take, I really hope you’re not making decisions that effect people.
- diggernet 4y agoI have the same opinion of people who want to control others because they "need to be protected from themselves".
- Godel_unicode 4y agoSo I take it you’re against food safety standards, seatbelt laws, taxes on cigarettes, the clean air act, payday loan reforms, etc. Most people will never understand this subject, and the fact that they don’t need to is a good thing. If you want a hobby, great, you can go figure out how to do that. The default needs to be safety.
- cmdli 4y agoSoftware-based passkeys can do this! Bulwark Passkey (https://bulwark.id https://bulwark.id) is a virtual Yubikey-like device, and you can back up the credentials file however you like.
- Robadob 4y agoI have two yubikeys too, but I definitely found services which didn't allow me to register more than one when I first set them up (a couple of years ago now).
- Semaphor 4y agoNot sure how it used to be, but the only braindead implementation like that I’ve seen was AWS.
- arianvanp 4y agoThey fixed this a few weeks ago.
- chrishynes 4y agoThey announced a fix but it hasn't rolled out everywhere yet -- it requires converting to a new "Amazon Web Service" login that is separate from your normal amazon.com account
- bostik 4y agoOh cool, this has been my number one complaint about AWS credentials management since early 2016 or so. Over the years I've talked to a number of their project and program managers and until 2019 (that is, before the plague) they all told me that they were aware of the problem but had no plans - or even intent to fix it. Apparently the one-set-of-credentials constraint is so deeply tied into their platform that fixing it was simply deemed infeasible. Appears that while they couldn't fix it, they have gone ahead with a workaround and made multi-device 2FA support a feature in a potential auth replacement system. Must have been a particularly frequent and loud complaint.
- orev 4y agoThe elephant in the room is that this just isn’t feasible for “normal” (non-IT) people, and those people are usually the ones who need strong protections, as they’re the ones with bad habits like choosing bad passwords, reusing passwords, forgetting them, etc.
- ilyt 4y agoI'd think password managers would be fine here. Also, don't fuck up other user's experience just because average one is clueless...
- goodoldneon 4y agoI use a password manager too. The yubikey is usually my second factor
- goodoldneon 4y agoYou’re totally right. I never recommend Yubikeys to non-technical people
- tuatoru 4y agoI bought four yubikeys back in 2012, two pairs as recommended - one in use, one backup. At the time Yubi had a video up of their keys being run over and otherwise maltreated, and still working. One of my keys failed spontaneously after a just few weeks in my pocket, on a ring with my other keys. I decided to stop using yubikeys. A password manager has worked very well for me ever since.
- ViViDboarder 4y agoI’ve had one on my keychain for at least 5 years now with no issues. It would have been longer but I did switch to a USB-C key two years ago. I kept the old one enrolled as my backup key. I use a password manager, but my Yubikey has all my 2FA. Including TOTP.
- Jayschwa 4y agoI had a YubiKey fail when I touched it and a static shock wiped its memory. I was able to reinitialize it using their app, but the previously loaded key was lost.
- spiffytech 4y ago> I have 2 yubikeys and always register them both How does this work? Do you have to physically retrieve both any time you sign up with a new service? If that's how it works, it sounds like a choice between two bad options: either having both of them handy at the same time, hurting redundancy, or registering them at separate times, hoping you remember to do both. Is that the case?
- goodoldneon 4y agoThat’s what I do. I keep my backup in a fireproof, airtight container
- jdfhfjdhjdhdfj 4y agoexcuse me if i think this is BS. You will have to retrieve your key when you sign to a new service. at this point you risk losing both. or are you saying you cloned the private keys and know how to correctly advance the counters when you need the backup?
- goodoldneon 4y agoI don’t use 2 factor for most sites. Do I really care if my HN account is compromised? So for sites that I do care about (e.g. GitHub), yes I register both. It isn’t as inconvenient as you’d think because I don’t sign up for many sites. Since I use my Yubikey for SSH, I’m frequently adding both Yubikeys as authorized keys on machines. But I keep an authorized_keys file with both public keys so I don’t need to physically grab my backup