5 ms·
> safe from any users without an authorized hardware key If you do this, make sure you support multiple hardware keys. Single Yubikey and no backup is not saf
by dheera 2y ago
> safe from any users without an authorized hardware key
If you do this, make sure you support multiple hardware keys.
Single Yubikey and no backup is not safe, since the key can be lost or damaged easily.
Single Yubikey and SMS backup or "contact customer service to reset" backup is NOT secure, as it reduces your security to that of SMS or the CS rep.
- elevation 2y agoI'd considered allowing users to provision a additional keys for backup, but only allowing one active key at any given time. If the active key is lost/destroyed, a self-serve portal allows them to disable their active key at any time. But activating a backup key would require a (different) administrator's approval.
- dheera 2y agoThat isn't a good workflow, in case the first administrator is sick or hospitalized and the second administrator needs to access it temporarily and is not in the same city. Also, I tend to leave Yubikeys permanently plugged into devices (1 per device) and register all the devices I have (4+) with every service. If any device is lost I would just login with another device disable that key. I also don't usually travel with keys unless I'm travelling with a portable device. When I move between two fixed desktops both in secured locations, the two desktops just have permanently-installed keys, I do not carry a key between them as walking around with a key is a liability.
- elevation 2y agoThanks for this feedback. I'll make sure to support multiple active keys as well.
- elevation 2y agoI want hardware attestation to be first-class, and not an afterthought. Since I'm integrating everything I can support a top-notch "lost key recovery" flow, whatever the requirements are.
- internet101010 2y agoYeah I have been sim swapped and can confidently say that SMS is not a valid form of 2FA.
- elevation 2y ago> I have been sim swapped and can confidently say that SMS is not a valid form of 2FA. Sounds like a money quote for the testimonials page!