3 ms·

I'm hesitant to rely on security keys after two of my Yubikey 5cs broke in the same month after ~3 years of ownership. Do we understand the lifetimes and and st

I'm hesitant to rely on security keys after two of my Yubikey 5cs broke in the same month after ~3 years of ownership. Do we understand the lifetimes and and stability of these devices? I think hardware security make a ton of sense for an enterprise environment, where you can go to IT and prove your identity to regain access. But, for something like Apple or Google - I'm sure the recovery process is not as easy. For a hardware crypto wallets, people go to extremes - safety deposit boxes, fire-proof recovery phrases, etc. But, for me - losing access to my core online accounts would be more destabilizing than losing money on a hardware wallet. Yet, we don't have the ultra-reliable backup methods in place for web auth like we do for crypto wallets.

themagician 4y ago
The security key here isn’t used for every login. So if you were to lose both it’s not like your account is completely disabled and all data lost. I think you can even use still use your Recovery Code. The Security Key here primarily replaces the 2FA authentication method for adding new devices to your account. From Apple’s own documentation: When you use Security Keys for Apple ID, you need a trusted device or a security key to: - Sign in with your Apple ID on a new device or on the web - Reset your Apple ID password or unlock your Apple ID - Add additional security keys or remove a security key I believe if you lose both you can still add another as long as you have access to a device that’s still logged in. The biggest hole in Apple’s security model, and one which has been documented to have been exploited many times, is people using phishing tactics to get the 6-digit 2FA code to gain iCloud access, adding a new device, then downloading the unencrypted backup from the victims primary device from iCloud. Security Keys and E2EE now make this impossible.
hellodanylo 4y ago
> I'm sure the recovery process is not as easy. A lot of services offer one-time backup codes and connecting multiple 2FA devices. Making Yubikey a single point of failure is certainly a bad idea.
hnbear 4y ago
I deployed 1000+ over 3+ years, and never had one break. It’s anecdata and I believe they can fail, but we never saw it once. Using the A and C nanos. Helped they were permanently in machines though. No mechanical risk.
ShredKazoo 4y ago
How did you end up recovering when your Yubikeys broke?
- gregoriol 4y ago
  You usually have some kind of backup codes when you set up a second factor auth
- philip1209 4y ago
  I didn't. I smashed them with a hammer and replaced them with new ones!
garyrob 4y ago
Wow, that's a bit scary to hear about. Maybe have 3 and test them monthly on a rotating basis.

themagician 4y ago

The security key here isn’t used for every login. So if you were to lose both it’s not like your account is completely disabled and all data lost. I think you can even use still use your Recovery Code. The Security Key here primarily replaces the 2FA authentication method for adding new devices to your account. From Apple’s own documentation: When you use Security Keys for Apple ID, you need a trusted device or a security key to: - Sign in with your Apple ID on a new device or on the web - Reset your Apple ID password or unlock your Apple ID - Add additional security keys or remove a security key I believe if you lose both you can still add another as long as you have access to a device that’s still logged in. The biggest hole in Apple’s security model, and one which has been documented to have been exploited many times, is people using phishing tactics to get the 6-digit 2FA code to gain iCloud access, adding a new device, then downloading the unencrypted backup from the victims primary device from iCloud. Security Keys and E2EE now make this impossible.

hellodanylo 4y ago

> I'm sure the recovery process is not as easy. A lot of services offer one-time backup codes and connecting multiple 2FA devices. Making Yubikey a single point of failure is certainly a bad idea.

hnbear 4y ago

I deployed 1000+ over 3+ years, and never had one break. It’s anecdata and I believe they can fail, but we never saw it once. Using the A and C nanos. Helped they were permanently in machines though. No mechanical risk.

ShredKazoo 4y ago

How did you end up recovering when your Yubikeys broke?

gregoriol 4y ago
You usually have some kind of backup codes when you set up a second factor auth
philip1209 4y ago
I didn't. I smashed them with a hammer and replaced them with new ones!

garyrob 4y ago

Wow, that's a bit scary to hear about. Maybe have 3 and test them monthly on a rotating basis.