2 ms·

Best practice is to have multiple Yubikeys, at least 2-3. You could leave one with a trusted person or family member. The odds of losing all of them simultaneou

Best practice is to have multiple Yubikeys, at least 2-3. You could leave one with a trusted person or family member. The odds of losing all of them simultaneously are slim.

tjoff 4y ago
Oh, I need a new account. Hang on, can we book a new meeting in two weeks? I have to gather all my security keys first.
NoZebra120vClip 4y ago
This is great, if you rarely add/update secrets and you also have easy, quick access to that offsite storage. It's not so great if you're constantly tapping your friend because you need to swap Yubikeys again and you both just get sick of that rigmarole. When setting up Yubikey, I discovered a tool, I think it's called "paperkey" and it lets you print out a GPG key after minting it. Have fun typing that back in! OCR ahoy! It's lower-tech, but my solution is to always have a comprehensive catalog of plaintext backup secrets stored offsite. This won't rely on anything electronic and it's easy to use. You just have to make a good effort to guard it from prying eyes, at least any eyes that also know your username and password. And likewise to some of the GPs, I'm skeptical of anything based on possession of an electronic thing that functions properly. The Yubikey is the best yet, because it's simple, purpose-built, and "virtually indestructible" as the marketing copy says. I would even love one of those RSA gadgets with a built-in display for purpose-built TOTP functionality. But paper's the best backup yet. Don't discount paper!
drowsspa 4y ago
I've read this a lot, but honestly is this really the future of security? Keep a Yubikey in your wallet, another in a bank safe, bury another in the family's farm... It doesn't scale at all. And in the end, it's all social-dependent, because one can always cry out in a Hacker News post or in a viral Twitter thread and you'll get access to your account back. But if things happened the way security experts seem to want, losing your two Yubikeys means you should just start life from scratch. I'd rather we find a way to actually involve real-world security instead of pretending the digital world doesn't depend on it.

Best practice is to have multiple Yubikeys, at least 2-3. You could leave one with a trusted person or family member. The odds of losing all of them simultaneously are slim.

tjoff 4y ago

Oh, I need a new account. Hang on, can we book a new meeting in two weeks? I have to gather all my security keys first.

NoZebra120vClip 4y ago

This is great, if you rarely add/update secrets and you also have easy, quick access to that offsite storage. It's not so great if you're constantly tapping your friend because you need to swap Yubikeys again and you both just get sick of that rigmarole. When setting up Yubikey, I discovered a tool, I think it's called "paperkey" and it lets you print out a GPG key after minting it. Have fun typing that back in! OCR ahoy! It's lower-tech, but my solution is to always have a comprehensive catalog of plaintext backup secrets stored offsite. This won't rely on anything electronic and it's easy to use. You just have to make a good effort to guard it from prying eyes, at least any eyes that also know your username and password. And likewise to some of the GPs, I'm skeptical of anything based on possession of an electronic thing that functions properly. The Yubikey is the best yet, because it's simple, purpose-built, and "virtually indestructible" as the marketing copy says. I would even love one of those RSA gadgets with a built-in display for purpose-built TOTP functionality. But paper's the best backup yet. Don't discount paper!

drowsspa 4y ago

I've read this a lot, but honestly is this really the future of security? Keep a Yubikey in your wallet, another in a bank safe, bury another in the family's farm... It doesn't scale at all. And in the end, it's all social-dependent, because one can always cry out in a Hacker News post or in a viral Twitter thread and you'll get access to your account back. But if things happened the way security experts seem to want, losing your two Yubikeys means you should just start life from scratch. I'd rather we find a way to actually involve real-world security instead of pretending the digital world doesn't depend on it.