3 ms·

So first of all: From my experience, Yubikeys are incredibly durable. I have one on a keychain for years now, completely beaten up and it's still working fine.

by deng 3y ago

So first of all: From my experience, Yubikeys are incredibly durable. I have one on a keychain for years now, completely beaten up and it's still working fine. If a Yubikey gets lost: on all our internal systems, an administrator will remove that Yubikey from the user's account and a new Yubikey is deployed. For a remote employee, we can usually switch to OTP until the new key arrives. For external systems, it is the responsibility of the employees to securely store their recovery keys. If these are gone, well then it depends on the service how tedious it will be to reset the 2FA for that account... it usually (and hopefully) involves some kind of manual identity verification process. Some people in critical positions simply get two Yubikeys.

technofiend 3y ago
>Some people in critical positions simply get two Yubikeys That really seems like the way to go for everyone, because of course when you lose access to the yubikey, it's suddenly far more challenging to get support via systems you may no longer be able to access. Google insists on two hardware MFA tokens for their elevated account protection program, most likely for this reason.
- deng 3y ago
  I agree, but for some reason the people responsible for the IT budget did not like that solution... (Yes, they are really not that expensive, but somehow it is pretty common that companies like to cheap out on the small stuff).
jmalicki 3y ago
I've destroyed two yubikeys in a 2017 MBP that would occasionally send excess voltage out of USB (I guess it was a bugged first-generation USB-C chipset), and one from leaving in on my keyring in my pocket in the laundry. It's possible to break, but it's not trivial.
- bennyg 3y ago
  Wow I thought I was the only one - fried a Yubikey and a Logitech webcam because I forgot I plugged it into the “cursed” port. Took a bit to convince IT to req me a new laptop.

by deng 3y ago

technofiend 3y ago

>Some people in critical positions simply get two Yubikeys That really seems like the way to go for everyone, because of course when you lose access to the yubikey, it's suddenly far more challenging to get support via systems you may no longer be able to access. Google insists on two hardware MFA tokens for their elevated account protection program, most likely for this reason.

deng 3y ago
I agree, but for some reason the people responsible for the IT budget did not like that solution... (Yes, they are really not that expensive, but somehow it is pretty common that companies like to cheap out on the small stuff).

jmalicki 3y ago

I've destroyed two yubikeys in a 2017 MBP that would occasionally send excess voltage out of USB (I guess it was a bugged first-generation USB-C chipset), and one from leaving in on my keyring in my pocket in the laundry. It's possible to break, but it's not trivial.

bennyg 3y ago
Wow I thought I was the only one - fried a Yubikey and a Logitech webcam because I forgot I plugged it into the “cursed” port. Took a bit to convince IT to req me a new laptop.