6 ms·
What happens if a Yubikey breaks?
by kwanbix 3y ago
What happens if a Yubikey breaks?
- lijok 3y agoYou always issue 2
- MadsRC 3y agoDo you though? It’s been my understanding that for corporate use, only a single one should be issued because: 1: There’s an establish support team in your org that can always issue a new one (except for a few edge cases, super critical things) 2: You can’t trust users with 2 devices For private use, nr. 1 would not be true so the recommendation rightly is to issue 2.
- DANmode 3y agoYour manager holds your backup. If you're their number two, possibly you hold theirs.
- eropple 3y agoI've never heard of this practice and would throw the book at anyone who implemented it in a shop I worked at. You keep both your keys, one securely and one at-the-ready.
- DANmode 3y agoThis is fair, but I have to note, a little out of date for startups which can be 100% remote to the point of founders not having a home city, let alone one stable, secure place to stash a backup. Yes, safety deposit boxes. Yes, family, yes friends. Yes, attorneys. But also what I said initially.
- darthwalsh 3y agoAt Google the IT desk had a jar of Yubikey. You could just take and enroll however many you wanted.
- androidbishop 3y agoGoogle was one of the earliest adopters of Yubikeys, and they used them for EVERYTHING. When I worked there, we always received 2 keys: one of those itty bitty ones that sits in your USB port permanently, and a regular key that fit into our security badge holder, or you could keep at home, or whatever. The switch to security keys reduced account takeovers to 0: https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu...
- netheril96 3y agoI have four. One attached to the desktop, one attached to the laptop, and two carried with all my mechanical keys (one of them supports NFC and another supports USB-C).
- androidbishop 3y agoglutton ;-p
- lokar 3y agoAnd if you somehow get locked out you can show up at the help desk in person, or VC in with your manager on the call to Id you
- lijok 3y agoI've not heard an argument before for why a user cannot be trusted with 2 keys
- Spooky23 3y agoIt depends on where you work. I’ve supported users who would eBay the second one, if they were smart enough to do that.
- diarrhea 3y agoBut is an engineers time not worth more than an additional key users can do self service with? Seems like a really thin argument given how cheap the keys can be.
- izacus 3y agoSame thing that happens if you forget your company login password.
- ccmcarey 3y agoFrom the article: > Nowadays, newly-onboarded Discord corporate users receive a laptop and at least one Yubikey alongside that laptop. IT onboards users to Okta and instructs them to register at least two WebAuthn authenticators; typically, this is their Macbook’s TouchID/Windows Hello sensor and also their Security Key C NFC. > We also instruct corporate users to set up Okta Verify for use only as a fallback MFA in the event that all their authenticators fail at once. This way, we never have user accounts lacking at least one strong form of multi-factor authentication. So OS level keys, a yubikey for roaming, and Okta Verify for fallback
- hnbear 3y agoIn addition, Okta Admins can also recover accounts, so loss of the Yubi doesn't mean the account is locked out forever. You can easily provision a different 2FA method. When we deployed we banned Verify (didn't want any OTP), but encouraged TouchID, and the Yubi. If someone was locked out we could temporarily enable Verify, or reset their Macbook or Okta access so they could reregister into either. But,in deploying 1500 or so yubikeys over a 5+ year period we never saw one actually break. Employees would often say they'd broken, but troubleshooting normally was user error. The worst we saw were a few cases where Yubis needed unplugging and replugging (sometimes being left out for an hour or so).
- danpalmer 3y agoLots of good answers, but the ultimate point is that you can lose work time, and that is an accepted part of the trade off. If I lose my Yubikey(s) my employer will pay me to wait until a replacement arrives because the security is worth that cost.
- wiredfool 3y agoHow often do yubikeys break? I’ve got one of the original ones (15 years old?) the must have been through the wash a dozen times and it still works.
- androidbishop 3y agoSame. These things are indestructible. LOSING a key, however, is totally in the cards.
- evandale 3y agoOn the veeeery bottom of my to-do list has been to get a 2nd yubikey in case mine breaks.... 9 years later I'm still procrastinating and after reading these comments I'm convinced I'm good for another couple years LOL I did have a nano though, it broke on me, but it was my company's key. I don't think the same holds for those ones.
- iFire 3y agoTake care. Github and Yubico revoked some yubikeys in 2019. https://www.zdnet.com/article/yubico-to-replace-vulnerable-yubikey-fips-security-keys/ https://www.zdnet.com/article/yubico-to-replace-vulnerable-y...
- deng 3y agoSo first of all: From my experience, Yubikeys are incredibly durable. I have one on a keychain for years now, completely beaten up and it's still working fine. If a Yubikey gets lost: on all our internal systems, an administrator will remove that Yubikey from the user's account and a new Yubikey is deployed. For a remote employee, we can usually switch to OTP until the new key arrives. For external systems, it is the responsibility of the employees to securely store their recovery keys. If these are gone, well then it depends on the service how tedious it will be to reset the 2FA for that account... it usually (and hopefully) involves some kind of manual identity verification process. Some people in critical positions simply get two Yubikeys.
- technofiend 3y ago>Some people in critical positions simply get two Yubikeys That really seems like the way to go for everyone, because of course when you lose access to the yubikey, it's suddenly far more challenging to get support via systems you may no longer be able to access. Google insists on two hardware MFA tokens for their elevated account protection program, most likely for this reason.
- deng 3y agoI agree, but for some reason the people responsible for the IT budget did not like that solution... (Yes, they are really not that expensive, but somehow it is pretty common that companies like to cheap out on the small stuff).
- jmalicki 3y agoI've destroyed two yubikeys in a 2017 MBP that would occasionally send excess voltage out of USB (I guess it was a bugged first-generation USB-C chipset), and one from leaving in on my keyring in my pocket in the laundry. It's possible to break, but it's not trivial.
- bennyg 3y agoWow I thought I was the only one - fried a Yubikey and a Logitech webcam because I forgot I plugged it into the “cursed” port. Took a bit to convince IT to req me a new laptop.
- gargablegar 3y agoYou use out of band non yubi key mfa and contact your support and they give you a new one. Been using them for a while it’s really not too much of a challenge. Also you just keep a bucket of non signed up ones at the office. Enrolling them is pretty easy.