3 ms·
The "have a backup token" workflow seems like tedious make-work. I have to remove it from its "safe place" and keep it proximate to my primary token while I enr
by EvanAnderson 2y ago
The "have a backup token" workflow seems like tedious make-work. I have to remove it from its "safe place" and keep it proximate to my primary token while I enroll it in everything my primary token is enrolled in.
The workflow to enroll a new backup token (when the primary is lost and the backup becomes the primary) also seems like tedious and error-prone make-work.
It would great if I could load my backup token's public key into my primary token and export a copy of the primary token's secrets, encrypted with the backup token's public key. When I lose my primary token I would only need to restore my backup token and be back in business. That eliminates the make-work of enrolling on the backup token.
Of course, this scheme allows for "cloning" of a token so it'll never be allowed by the "security" nannies who know better than us.
- xur17 2y ago> It would great if I could load my backup token's public key into my primary token and export a copy of the primary token's secrets, encrypted with the backup token's public key. When I lose my primary token I would only need to restore my backup token and be back in business. That eliminates the make-work of enrolling on the backup token. Yes, exactly this. At one point I had a list of services that I utilize along with a list of the yubikeys I had enrolled on each. My plan was to enroll my backup key periodically (retrieving it from its safe place to do so). This ended up being a giant pita, and despite my best efforts, the list became out of date. In the end I just use Google Authenticator for everything since I can back it up.
- Biganon 2y agoMy Yubikey is only used as a factor to enable access to my password manager from a new computer. I only need it when I reinstall my computer or buy a new one.
- prmoustache 2y agoThe things you use only once every so many years is typically the kind of things you can't find the day you need it. Unless it is stored in a safe in a bank.
- Biganon 2y agoI'd have to lose BOTH to lose access to my password manager: the one that's attached to my keychain in my pocket, AND the one that's at home in a drawer. That'd be quite the bad luck.