5 ms·

To avoid this 2:n issue, I make 2 yubikeys that are clones of each other, and leave one in a secure location at all times. The sites cant tell the difference ap

by zen_1 3y ago

To avoid this 2:n issue, I make 2 yubikeys that are clones of each other, and leave one in a secure location at all times. The sites cant tell the difference apart from serial number

jhogendorn 3y ago
How do you make clones of a yubikey? Is this normal functionality I've missed or a hack?
- sneakerblack 3y ago
  Most likely they just mean that every time they register a new account, they get their backup yubikey out and add the account to it too It's not possible to clone yubikeys
NoZebra120vClip 3y ago
That's fine, but you can't keep them identical for long, because eventually you need to add/delete/update an account or a secret. So you're perpetually rotating that one in a secure location, and if your accounts have enough churn, it's a chore.
wesapien 3y ago
Can you dd one Yubikey to another?
- zen_1 3y ago
  At setup time, yes. https://support.yubico.com/hc/en-us/articles/360016614880-Can-I-Duplicate-or-Back-Up-a-YubiKey- https://support.yubico.com/hc/en-us/articles/360016614880-Ca... Look at the "few exceptions" section
  - NoZebra120vClip 3y ago
    If you grab a TOTP secret at setup time, you can do whatever you please with it, but this is of course extremely perilous, because access to the secret equals full control of that factor. The Yubikey's one-way storage is trying to save you from that danger. So one strategy for maintaining multiple authenticators or yubikeys would be to save all the secrets away and call them up when it's time to load up the alternate factor. What I do is register both keys at the same time, one after the other so the QR code doesn't leave my screen. Can't do it this way if the one key is in cold storage, of course.
- NoZebra120vClip 3y ago
  > Can you dd one Yubikey to another? If you're referring to the Unix tool "dd" the answer is unambiguously no; zen_1 misunderstood you. No data comes out of the Yubikey except answers to the cryptographic queries. There's no storage to dd. The only way to clone secrets is to grab them before they go in and save them elsewhere. That's what we mean by "time of setup" or "time of programming" is when putting a new secret in, not like initial setup of the device.
  - wesapien 3y ago
    Yes that's what I meant

by zen_1 3y ago

To avoid this 2:n issue, I make 2 yubikeys that are clones of each other, and leave one in a secure location at all times. The sites cant tell the difference apart from serial number

jhogendorn 3y ago

How do you make clones of a yubikey? Is this normal functionality I've missed or a hack?

sneakerblack 3y ago
Most likely they just mean that every time they register a new account, they get their backup yubikey out and add the account to it too It's not possible to clone yubikeys

NoZebra120vClip 3y ago

That's fine, but you can't keep them identical for long, because eventually you need to add/delete/update an account or a secret. So you're perpetually rotating that one in a secure location, and if your accounts have enough churn, it's a chore.

wesapien 3y ago

Can you dd one Yubikey to another?

zen_1 3y ago
At setup time, yes. https://support.yubico.com/hc/en-us/articles/360016614880-Can-I-Duplicate-or-Back-Up-a-YubiKey- https://support.yubico.com/hc/en-us/articles/360016614880-Ca... Look at the "few exceptions" section
- NoZebra120vClip 3y ago
  If you grab a TOTP secret at setup time, you can do whatever you please with it, but this is of course extremely perilous, because access to the secret equals full control of that factor. The Yubikey's one-way storage is trying to save you from that danger. So one strategy for maintaining multiple authenticators or yubikeys would be to save all the secrets away and call them up when it's time to load up the alternate factor. What I do is register both keys at the same time, one after the other so the QR code doesn't leave my screen. Can't do it this way if the one key is in cold storage, of course.
NoZebra120vClip 3y ago
> Can you dd one Yubikey to another? If you're referring to the Unix tool "dd" the answer is unambiguously no; zen_1 misunderstood you. No data comes out of the Yubikey except answers to the cryptographic queries. There's no storage to dd. The only way to clone secrets is to grab them before they go in and save them elsewhere. That's what we mean by "time of setup" or "time of programming" is when putting a new secret in, not like initial setup of the device.
- wesapien 3y ago
  Yes that's what I meant