3 ms·

In normal life losing access to your phone won't lock you out of everything. You still have all your other devices you can use AND you can always just walk into

In normal life losing access to your phone won't lock you out of everything. You still have all your other devices you can use AND you can always just walk into store and buy yourself a replacement and download your phone back from a backup. Same with laptops. If you go to a conference and your laptop breaks. You can just go to nearest store and buy a new one. It will take couple hours, but you'll be up and running again. With security key if you lose it you lose access immediately to your stuff and you probably can not get a new one with in 24 hours even if money wasn't an issue. Also after you get the key there is no way to authenticate yourself to the key in a way that you can just make it a copy of your previous key. Wallet is the best example. If you lose your wallet you need to kill your credit cards and get a new ID. However this does not lock you out of anything. You can go to your bank and take out whatever amount of money you need and order a new card, this will be inconvenient for about week. With your ID it depends on the schedules. However there is clear path to recovery.

macNchz 4y ago
> With security key if you lose it you lose access immediately to your stuff and you probably can not get a new one with in 24 hours even if money wasn't an issue. If you lose it while traveling and have a backup at home you can likely have someone overnight the backup to you in pretty close to 24h. You also only lose access to stuff that requires the key every time you access it, all but the most sensitive services will keep you logged in without the key for a period of time. > Wallet is the best example. If you lose your wallet you need to kill your credit cards and get a new ID. However this does not lock you out of anything. You can go to your bank and take out whatever amount of money you need In the US at least you’ll find the bank wants to see your ID to let you withdraw cash, and businesses are becoming less friendly to paying cash. Though, like a security key, many people have a spare id at home in the form of a passport.
eropple 4y ago
I can still get into "life stuff" without my Yubikey. There are increases in risk to doing so (TOTP requests have decreased resistance to phishing attacks versus webauthn, for example), which is why I don't do that generally, but the fallbacks are not a serious problem. I would have to lose/break my phone and my laptop (both secured via Apple's stuff, not my Yubikey) and my Yubikey to be materially locked out of things. And, at that point, my password vault is inaccessible to me and I have much bigger problems. The only thing I cannot do without a Yubikey is SSH into systems, and that is, for me, a worthwhile thing to break-glass on.
- nextlevelwizard 4y ago
  If you only use the key to SSH then fine, but then I am not willing to pay more than 10€ for set of two.

macNchz 4y ago

> With security key if you lose it you lose access immediately to your stuff and you probably can not get a new one with in 24 hours even if money wasn't an issue. If you lose it while traveling and have a backup at home you can likely have someone overnight the backup to you in pretty close to 24h. You also only lose access to stuff that requires the key every time you access it, all but the most sensitive services will keep you logged in without the key for a period of time. > Wallet is the best example. If you lose your wallet you need to kill your credit cards and get a new ID. However this does not lock you out of anything. You can go to your bank and take out whatever amount of money you need In the US at least you’ll find the bank wants to see your ID to let you withdraw cash, and businesses are becoming less friendly to paying cash. Though, like a security key, many people have a spare id at home in the form of a passport.

eropple 4y ago

I can still get into "life stuff" without my Yubikey. There are increases in risk to doing so (TOTP requests have decreased resistance to phishing attacks versus webauthn, for example), which is why I don't do that generally, but the fallbacks are not a serious problem. I would have to lose/break my phone and my laptop (both secured via Apple's stuff, not my Yubikey) and my Yubikey to be materially locked out of things. And, at that point, my password vault is inaccessible to me and I have much bigger problems. The only thing I cannot do without a Yubikey is SSH into systems, and that is, for me, a worthwhile thing to break-glass on.

nextlevelwizard 4y ago
If you only use the key to SSH then fine, but then I am not willing to pay more than 10€ for set of two.