5 ms·

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessiv

I like the idea of securitykeys, but having to drop 100€ for a key (since in my opinion you are playing with fire if you don't buy a backup) feels like excessive and then having to worry that I remember to take my securitykey with me everywhere... Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience.

joshvm 4y ago
You can also use the cheap ones, they work just as well for consumer purposes: https://www.yubico.com/ch/product/security-key-nfc-by-yubico-black/ https://www.yubico.com/ch/product/security-key-nfc-by-yubico... The only irritating bit is when you don't have USB-A (there is no A+C stick). But with NFC at least you can use your phone. I've yet to find a place (in my life anyway) where FIDO isn't accepted. Secures the main things like Google, Namecheap, etc.
- lxgr 4y ago
  That's one reason why I prefer USB-A security keys (it's just more ubiquitous at this point, and A-to-C adapters are readily available, while the reverse is out of USB spec). The other is that USB-A has all moving parts in the socket (vs. in the cable-side plug), which presumably makes a USB-A key more reliable. I've had USB-C keys break on me mechanically, so having an A-to-C adapter with moving parts on both sides seems like the best of both worlds (durable security key, durable device-side port, easily replaceable adapter).
sverhagen 4y ago
>a backup >convenience I always wonder how often someone gets into a crisis because their Yubikey breaks while they're at, say, a conference (ie. far away from the backup, be it another key, or access to recover codes). I recon they can just break when plugged into a laptop that takes a dive.
- donkeyd 4y ago
  Most people have only their phones, which can also break. But some people only start thinking about that stuff when they look at alternatives like the Yubikey. > they can just break when plugged into a laptop that takes a dive So can the laptop at a conference. Or anything else really. I just remove my Yubikey after use and carry it in my wallet when not in use. Sure, I can lose my wallet, but I have multiple back-up options for the Yubikey, I mostly use it for convenience.
  - nextlevelwizard 4y ago
    In normal life losing access to your phone won't lock you out of everything. You still have all your other devices you can use AND you can always just walk into store and buy yourself a replacement and download your phone back from a backup. Same with laptops. If you go to a conference and your laptop breaks. You can just go to nearest store and buy a new one. It will take couple hours, but you'll be up and running again. With security key if you lose it you lose access immediately to your stuff and you probably can not get a new one with in 24 hours even if money wasn't an issue. Also after you get the key there is no way to authenticate yourself to the key in a way that you can just make it a copy of your previous key. Wallet is the best example. If you lose your wallet you need to kill your credit cards and get a new ID. However this does not lock you out of anything. You can go to your bank and take out whatever amount of money you need and order a new card, this will be inconvenient for about week. With your ID it depends on the schedules. However there is clear path to recovery.
    - macNchz 4y ago
      > With security key if you lose it you lose access immediately to your stuff and you probably can not get a new one with in 24 hours even if money wasn't an issue. If you lose it while traveling and have a backup at home you can likely have someone overnight the backup to you in pretty close to 24h. You also only lose access to stuff that requires the key every time you access it, all but the most sensitive services will keep you logged in without the key for a period of time. > Wallet is the best example. If you lose your wallet you need to kill your credit cards and get a new ID. However this does not lock you out of anything. You can go to your bank and take out whatever amount of money you need In the US at least you’ll find the bank wants to see your ID to let you withdraw cash, and businesses are becoming less friendly to paying cash. Though, like a security key, many people have a spare id at home in the form of a passport.
Hesinde 4y ago
I solve the issue of forgetting my key by having a key constantly attached to my keychain with a keychain clip except when its in use with my notebook. This means that I have three keys - one on my keychain, one on my main computer, and one for backup. Also I have my passwords synced to my phone, which could serve as a mobile backup in a pinch. I currently have it configured to require the key, but I should probably change that now that I think about the possibility of losing the key. Using the key is more convenient to me than not using it, because it saves me from having to remember and enter a long master password.
ptman 4y ago
https://www.token2.com/shop/product/fido-bundle-2-x-fido2-usb-keys https://www.token2.com/shop/product/fido-bundle-2-x-fido2-us... ? or https://www.token2.com/shop/product/token2-t2f2-typec-fido2-and-u2f-security-key https://www.token2.com/shop/product/token2-t2f2-typec-fido2-... , but there's no 2x bundle.
vifon 4y ago
> Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience. In terms of the SSH and GPG keys which I use multiple times every single day for me this is convenience. I have my keys always on my person and they are tied to me, and not a particular machine. Whether it's my laptop, my desktop or my phone, I have a single pair of keys that are virtually impossible to steal even on a so-so trusted device like a proprietary phone. When you start considering a security key as a portable credential storage to use across all your machines, it becomes actually more convenient, not less.
- nextlevelwizard 4y ago
  I am just not at all paranoid about my SSH keys. Those are password protected and the worst that you can do with them is to run some low yield miner on my machines. I guess you could "steal" my source code, but I publish it free on github anyway. Maybe convenient if you are administrator or something, but for normal life seems unnecessary. However I can see the appeal of having everything behind a physical factor
agotterer 4y ago
I’ve carried a USB-A Yubikey in my pocket for 7 years and it’s never broke. I also keep one time login passwords encrypted and available in the cloud in the event I lose the key.
- lxgr 4y ago
  I've had one USB-C key break on me in the past, and my replacement is already showing signs of wear. Fortunately it's not my only way to get back into my accounts if it breaks. My (sample size 2) theory is that USB-C isn't the best connector for a security key, since it intentionally moves the wear-prone part (i.e. the dust-collecting and mechanical spring involving side) from the port to the cable. USB-A is completely solid state, and most security keys use the "flat" variant of the plug that further reduces the chance of mechanical damage and/or collecting dust.
  - fullstop 4y ago
    You can buy dust covers for USB-C male connectors.
    - lxgr 4y ago
      Sure, but that doesn't help against the springs mechanically wearing out, or mechanical damage bending the hollow part of the USB-C connector. Looking at all of my USB-C keys, most of them get visibly bent inwards after a couple of years of carrying them in a pocket on a keychain with other keys. It's hard to imagine a USB-A key breaking in the same way. The only thing that could conceivably break it is the PCB itself snapping, or possibly static electricity (but I don't know how much better USB-C keys would fare in that regard). So given that I can buy 2-3 A-to-C adapters for the price difference between a USB-A and a USB-C key, why take the additional risk?
      - fullstop 4y ago
        Yes, I have both an A and a C in use. If I could keep an A-to-C adapter on my keychain that would be a good option as well. Type A is more durable, for sure.
ixwt 4y ago
If you setup a domain to use Cloudflare, and then sign up for their zero trust system, you can get a code to get up to 4 yuibkey's for $10 each.
- jrib 4y ago
  Is this still the case? I came across this blog post about a similar offer: https://blog.cloudflare.com/making-phishing-defense-seamless-cloudflare-yubico/ https://blog.cloudflare.com/making-phishing-defense-seamless... but it now states: > UPDATE: This offer expired on January 3rd, 2023 at 8am PST.
  - ngai_aku 4y ago
    Yeah, I don’t think it’s live anymore. I had the same feelings as gp re: up front price, so I went searching for deals and came across that cloudflare offer on Reddit. Several users have commented on the thread post-January 3rd stating that they tried and failed to unlock the deal
- thesuitonym 4y ago
  Are these the good Yubikeys or the basic FIDO-only models?
  - piperswe 4y ago
    Back when this promo was still going on, they were the good ones
stavros 4y ago
Buy any FIDO2-compatible key for 15-20 EUR, they all do the same thing (or use TouchID if you're using a Mac, but you'll want backup for that).
Arch-TK 4y ago
The cost is not really that enormous when you consider these things are pretty bulletproof, I've had one for about 10 years on my keychain. That's €5 per year. I am currently waiting for NitroKey 3 to have non-alpha OpenPGP SC support and will likely buy one as soon as it's available (although maybe I should buy one now to support development and maybe have a play around myself). You don't need a backup unless you don't trust your hardware at home, just store backup keys on some trusted host, or offline on some storage media, you then only need to buy a new security key whenever you lose yours. Even so, if you DO decide to go the backup route, the backup is not likely to get list and very likely to last much longer than 10 years. With security keys which have NFC capabilities, you can set things up so that accessing any website from your phone is only a tap away (you need to enter the pin before hand, or every time, obviously choice of convenience here is up to you but if your phone itself is secure enough then maybe this isn't such an issue to keep the pin cached while the phone is on).
hummus_bae 4y ago
[dead]
hot_gril 4y ago
Same, I only use the key when something forces me to, cause I trust TOTP authentication apps even less. (I don't mean trusting that nobody hacks it, I mean trusting that I don't get locked out.)
- Melatonic 4y ago
  Thankfully now with Google Authenticator at least you can export the config to another device. I periodically do this to my old Android phone so I have a backup device in case I destroy my current one
  - hot_gril 4y ago
    Yeah but I already wrote off Goog Authenticator after last time. The original version didn't let you transfer codes, and the devs said that's WAI for so long before listening to common sense. Also, such a strict auth system needs to be 100% clear what my credentials are and where they're stored, and it's unclear here. People today still get confused about whether or not Android or iPhone backups (local or cloud) contain them. They could've taken a page from the cryptocurrency wallets, which give you a recovery word-list upon first setup and force you to understand how it works.
SomeHacker44 4y ago
I found that four were the right number of keys, not two. One for the permanent safe, one for the keyring, one for offsite storage at another location (like office) and one to leave in the computer.

joshvm 4y ago

You can also use the cheap ones, they work just as well for consumer purposes: https://www.yubico.com/ch/product/security-key-nfc-by-yubico-black/ https://www.yubico.com/ch/product/security-key-nfc-by-yubico... The only irritating bit is when you don't have USB-A (there is no A+C stick). But with NFC at least you can use your phone. I've yet to find a place (in my life anyway) where FIDO isn't accepted. Secures the main things like Google, Namecheap, etc.

lxgr 4y ago
That's one reason why I prefer USB-A security keys (it's just more ubiquitous at this point, and A-to-C adapters are readily available, while the reverse is out of USB spec). The other is that USB-A has all moving parts in the socket (vs. in the cable-side plug), which presumably makes a USB-A key more reliable. I've had USB-C keys break on me mechanically, so having an A-to-C adapter with moving parts on both sides seems like the best of both worlds (durable security key, durable device-side port, easily replaceable adapter).

sverhagen 4y ago

>a backup >convenience I always wonder how often someone gets into a crisis because their Yubikey breaks while they're at, say, a conference (ie. far away from the backup, be it another key, or access to recover codes). I recon they can just break when plugged into a laptop that takes a dive.

donkeyd 4y ago
Most people have only their phones, which can also break. But some people only start thinking about that stuff when they look at alternatives like the Yubikey. > they can just break when plugged into a laptop that takes a dive So can the laptop at a conference. Or anything else really. I just remove my Yubikey after use and carry it in my wallet when not in use. Sure, I can lose my wallet, but I have multiple back-up options for the Yubikey, I mostly use it for convenience.
- nextlevelwizard 4y ago
  In normal life losing access to your phone won't lock you out of everything. You still have all your other devices you can use AND you can always just walk into store and buy yourself a replacement and download your phone back from a backup. Same with laptops. If you go to a conference and your laptop breaks. You can just go to nearest store and buy a new one. It will take couple hours, but you'll be up and running again. With security key if you lose it you lose access immediately to your stuff and you probably can not get a new one with in 24 hours even if money wasn't an issue. Also after you get the key there is no way to authenticate yourself to the key in a way that you can just make it a copy of your previous key. Wallet is the best example. If you lose your wallet you need to kill your credit cards and get a new ID. However this does not lock you out of anything. You can go to your bank and take out whatever amount of money you need and order a new card, this will be inconvenient for about week. With your ID it depends on the schedules. However there is clear path to recovery.
  - macNchz 4y ago
    > With security key if you lose it you lose access immediately to your stuff and you probably can not get a new one with in 24 hours even if money wasn't an issue. If you lose it while traveling and have a backup at home you can likely have someone overnight the backup to you in pretty close to 24h. You also only lose access to stuff that requires the key every time you access it, all but the most sensitive services will keep you logged in without the key for a period of time. > Wallet is the best example. If you lose your wallet you need to kill your credit cards and get a new ID. However this does not lock you out of anything. You can go to your bank and take out whatever amount of money you need In the US at least you’ll find the bank wants to see your ID to let you withdraw cash, and businesses are becoming less friendly to paying cash. Though, like a security key, many people have a spare id at home in the form of a passport.

Hesinde 4y ago

I solve the issue of forgetting my key by having a key constantly attached to my keychain with a keychain clip except when its in use with my notebook. This means that I have three keys - one on my keychain, one on my main computer, and one for backup. Also I have my passwords synced to my phone, which could serve as a mobile backup in a pinch. I currently have it configured to require the key, but I should probably change that now that I think about the possibility of losing the key. Using the key is more convenient to me than not using it, because it saves me from having to remember and enter a long master password.

ptman 4y ago

https://www.token2.com/shop/product/fido-bundle-2-x-fido2-usb-keys https://www.token2.com/shop/product/fido-bundle-2-x-fido2-us... ? or https://www.token2.com/shop/product/token2-t2f2-typec-fido2-and-u2f-security-key https://www.token2.com/shop/product/token2-t2f2-typec-fido2-... , but there's no 2x bundle.

vifon 4y ago

> Yeah, yeah, security vs. convenience is always the issue, but so far I've just selected convenience. In terms of the SSH and GPG keys which I use multiple times every single day for me this is convenience. I have my keys always on my person and they are tied to me, and not a particular machine. Whether it's my laptop, my desktop or my phone, I have a single pair of keys that are virtually impossible to steal even on a so-so trusted device like a proprietary phone. When you start considering a security key as a portable credential storage to use across all your machines, it becomes actually more convenient, not less.

nextlevelwizard 4y ago
I am just not at all paranoid about my SSH keys. Those are password protected and the worst that you can do with them is to run some low yield miner on my machines. I guess you could "steal" my source code, but I publish it free on github anyway. Maybe convenient if you are administrator or something, but for normal life seems unnecessary. However I can see the appeal of having everything behind a physical factor

agotterer 4y ago

I’ve carried a USB-A Yubikey in my pocket for 7 years and it’s never broke. I also keep one time login passwords encrypted and available in the cloud in the event I lose the key.

lxgr 4y ago
I've had one USB-C key break on me in the past, and my replacement is already showing signs of wear. Fortunately it's not my only way to get back into my accounts if it breaks. My (sample size 2) theory is that USB-C isn't the best connector for a security key, since it intentionally moves the wear-prone part (i.e. the dust-collecting and mechanical spring involving side) from the port to the cable. USB-A is completely solid state, and most security keys use the "flat" variant of the plug that further reduces the chance of mechanical damage and/or collecting dust.
- fullstop 4y ago
  You can buy dust covers for USB-C male connectors.
  - lxgr 4y ago
    Sure, but that doesn't help against the springs mechanically wearing out, or mechanical damage bending the hollow part of the USB-C connector. Looking at all of my USB-C keys, most of them get visibly bent inwards after a couple of years of carrying them in a pocket on a keychain with other keys. It's hard to imagine a USB-A key breaking in the same way. The only thing that could conceivably break it is the PCB itself snapping, or possibly static electricity (but I don't know how much better USB-C keys would fare in that regard). So given that I can buy 2-3 A-to-C adapters for the price difference between a USB-A and a USB-C key, why take the additional risk?
    - fullstop 4y ago
      Yes, I have both an A and a C in use. If I could keep an A-to-C adapter on my keychain that would be a good option as well. Type A is more durable, for sure.

ixwt 4y ago

If you setup a domain to use Cloudflare, and then sign up for their zero trust system, you can get a code to get up to 4 yuibkey's for $10 each.

jrib 4y ago
Is this still the case? I came across this blog post about a similar offer: https://blog.cloudflare.com/making-phishing-defense-seamless-cloudflare-yubico/ https://blog.cloudflare.com/making-phishing-defense-seamless... but it now states: > UPDATE: This offer expired on January 3rd, 2023 at 8am PST.
- ngai_aku 4y ago
  Yeah, I don’t think it’s live anymore. I had the same feelings as gp re: up front price, so I went searching for deals and came across that cloudflare offer on Reddit. Several users have commented on the thread post-January 3rd stating that they tried and failed to unlock the deal
thesuitonym 4y ago
Are these the good Yubikeys or the basic FIDO-only models?
- piperswe 4y ago
  Back when this promo was still going on, they were the good ones

stavros 4y ago

Buy any FIDO2-compatible key for 15-20 EUR, they all do the same thing (or use TouchID if you're using a Mac, but you'll want backup for that).

Arch-TK 4y ago

The cost is not really that enormous when you consider these things are pretty bulletproof, I've had one for about 10 years on my keychain. That's €5 per year. I am currently waiting for NitroKey 3 to have non-alpha OpenPGP SC support and will likely buy one as soon as it's available (although maybe I should buy one now to support development and maybe have a play around myself). You don't need a backup unless you don't trust your hardware at home, just store backup keys on some trusted host, or offline on some storage media, you then only need to buy a new security key whenever you lose yours. Even so, if you DO decide to go the backup route, the backup is not likely to get list and very likely to last much longer than 10 years. With security keys which have NFC capabilities, you can set things up so that accessing any website from your phone is only a tap away (you need to enter the pin before hand, or every time, obviously choice of convenience here is up to you but if your phone itself is secure enough then maybe this isn't such an issue to keep the pin cached while the phone is on).

hummus_bae 4y ago

[dead]

hot_gril 4y ago

Same, I only use the key when something forces me to, cause I trust TOTP authentication apps even less. (I don't mean trusting that nobody hacks it, I mean trusting that I don't get locked out.)

Melatonic 4y ago
Thankfully now with Google Authenticator at least you can export the config to another device. I periodically do this to my old Android phone so I have a backup device in case I destroy my current one
- hot_gril 4y ago
  Yeah but I already wrote off Goog Authenticator after last time. The original version didn't let you transfer codes, and the devs said that's WAI for so long before listening to common sense. Also, such a strict auth system needs to be 100% clear what my credentials are and where they're stored, and it's unclear here. People today still get confused about whether or not Android or iPhone backups (local or cloud) contain them. They could've taken a page from the cryptocurrency wallets, which give you a recovery word-list upon first setup and force you to understand how it works.

SomeHacker44 4y ago

I found that four were the right number of keys, not two. One for the permanent safe, one for the keyring, one for offsite storage at another location (like office) and one to leave in the computer.