4 ms·

Yubikey Authenticator

17 points by bpierre 3y ago

footlose_3815 3y ago
Moving from Google authenticator to another application is extremely simple. I don't know why the author has so much trouble transferring 2FA. You take a picture of a QR code and it's all done for you. (This is also a good way to backup your tokens on a different device) With that being said I love my yubikey and want to try this app.
- dp-hackernews 3y ago
  Storing the text version of the QR code is the easiest, and its how bitwarden stores the 2FA anyway....
  - NoZebra120vClip 3y ago
    There is an extra wrinkle, too: Many MFA implementations will not allow you to register more than 1 TOTP authenticator, and so that is why I typically use the trick of registering both Yubikeys simultaneously. If you wish to register another, the service will often require you to deactivate MFA and set it up from scratch, which de-registers the original one. I think this is probably mandatory, due to the way the secrets work. There's no way a service can safely store such a secret on-site, because this would defeat the purpose. So in fact, if your alternate key/auth is offsite, then you're actually forced to manage your own secrets in order to properly register all affected devices. You can have BitWarden or another password manager manage those secrets for you, but you've just reduced your MFA to 1FA, because obviously that's where you store your passwords. In fact, revealing a TOTP secret is more damaging than revealing a simple password. But, you do you...
- NoZebra120vClip 3y ago
  It wasn't always this way. Google Authenticator used to be much more secure. That is to say, it closely guarded all the secrets and they never left the app. Unfortunately they had to bend to pressure of convenience for users, and that meant that now you can extract the secrets and push them around to your heart's content. That also means that an attacker can do likewise, or intercept them in transit, and so you lose the safety of a security key that is a "roach motel" for secrets. I don't know about the author, but it seems there are still problems with secret portability. If your phone breaks, or it's stolen, and you have no access to the app, how're you going to export your secrets now? The other cool thing about Yubikeys is that they're purpose-built, inexpensive, single-purpose. I don't want to be using my phone as a Swiss Army Knife authenticator. That's way too risky and dumb. It has a huge attack surface. Any malware could get at the phone. Plus all the risks of loss, breakage, or theft. A key can stay safe on my keyring and is "nearly indestructible" and it does only that one thing very well.
Z7YCx5ieof4Std 3y ago
I don't know if it's still the issue, but even the yubikey has its limits. It's a max of (from memory) 32 2fa codes. Which seems a lot but isn't really
- mrklol 3y ago
  Oh wow, 32 isn’t a lot.
NoZebra120vClip 3y ago
This is a good description of the Yubikey advantage. However, now that Authenticator apps are making it easier (and less secure) for you to move your secrets to new devices, this only underscores your need to register at least two Yubikeys in each place where you use TOTP, and don't forget those paper backup codes as well. TOTP (and other) secrets will never come out of a Yubikey once they've been sent into it. And I like it that way.
- zen_1 3y ago
  To avoid this 2:n issue, I make 2 yubikeys that are clones of each other, and leave one in a secure location at all times. The sites cant tell the difference apart from serial number
  - jhogendorn 3y ago
    How do you make clones of a yubikey? Is this normal functionality I've missed or a hack?
    - sneakerblack 3y ago
      Most likely they just mean that every time they register a new account, they get their backup yubikey out and add the account to it too It's not possible to clone yubikeys
  - NoZebra120vClip 3y ago
    That's fine, but you can't keep them identical for long, because eventually you need to add/delete/update an account or a secret. So you're perpetually rotating that one in a secure location, and if your accounts have enough churn, it's a chore.
  - wesapien 3y ago
    Can you dd one Yubikey to another?
    - zen_1 3y ago

17 points by bpierre 3y ago

Moving from Google authenticator to another application is extremely simple. I don't know why the author has so much trouble transferring 2FA. You take a picture of a QR code and it's all done for you. (This is also a good way to backup your tokens on a different device) With that being said I love my yubikey and want to try this app.

dp-hackernews 3y ago
Storing the text version of the QR code is the easiest, and its how bitwarden stores the 2FA anyway....
- NoZebra120vClip 3y ago
  There is an extra wrinkle, too: Many MFA implementations will not allow you to register more than 1 TOTP authenticator, and so that is why I typically use the trick of registering both Yubikeys simultaneously. If you wish to register another, the service will often require you to deactivate MFA and set it up from scratch, which de-registers the original one. I think this is probably mandatory, due to the way the secrets work. There's no way a service can safely store such a secret on-site, because this would defeat the purpose. So in fact, if your alternate key/auth is offsite, then you're actually forced to manage your own secrets in order to properly register all affected devices. You can have BitWarden or another password manager manage those secrets for you, but you've just reduced your MFA to 1FA, because obviously that's where you store your passwords. In fact, revealing a TOTP secret is more damaging than revealing a simple password. But, you do you...
NoZebra120vClip 3y ago
It wasn't always this way. Google Authenticator used to be much more secure. That is to say, it closely guarded all the secrets and they never left the app. Unfortunately they had to bend to pressure of convenience for users, and that meant that now you can extract the secrets and push them around to your heart's content. That also means that an attacker can do likewise, or intercept them in transit, and so you lose the safety of a security key that is a "roach motel" for secrets. I don't know about the author, but it seems there are still problems with secret portability. If your phone breaks, or it's stolen, and you have no access to the app, how're you going to export your secrets now? The other cool thing about Yubikeys is that they're purpose-built, inexpensive, single-purpose. I don't want to be using my phone as a Swiss Army Knife authenticator. That's way too risky and dumb. It has a huge attack surface. Any malware could get at the phone. Plus all the risks of loss, breakage, or theft. A key can stay safe on my keyring and is "nearly indestructible" and it does only that one thing very well.

Z7YCx5ieof4Std 3y ago

I don't know if it's still the issue, but even the yubikey has its limits. It's a max of (from memory) 32 2fa codes. Which seems a lot but isn't really

mrklol 3y ago
Oh wow, 32 isn’t a lot.

NoZebra120vClip 3y ago

This is a good description of the Yubikey advantage. However, now that Authenticator apps are making it easier (and less secure) for you to move your secrets to new devices, this only underscores your need to register at least two Yubikeys in each place where you use TOTP, and don't forget those paper backup codes as well. TOTP (and other) secrets will never come out of a Yubikey once they've been sent into it. And I like it that way.

zen_1 3y ago
To avoid this 2:n issue, I make 2 yubikeys that are clones of each other, and leave one in a secure location at all times. The sites cant tell the difference apart from serial number
- jhogendorn 3y ago
  How do you make clones of a yubikey? Is this normal functionality I've missed or a hack?
  - sneakerblack 3y ago
    Most likely they just mean that every time they register a new account, they get their backup yubikey out and add the account to it too It's not possible to clone yubikeys
- NoZebra120vClip 3y ago
  That's fine, but you can't keep them identical for long, because eventually you need to add/delete/update an account or a secret. So you're perpetually rotating that one in a secure location, and if your accounts have enough churn, it's a chore.
- wesapien 3y ago
  Can you dd one Yubikey to another?
  - zen_1 3y ago