Hacker News new | ask | show | jobs
by chrisper 3471 days ago
I have never owned a YubiKey before. What happens if you lose it or if it gets damaged? Can you get it replaced or is it like losing a keyfile?
2 comments

You lose it and it's gone. You can't remove credentials on the device. This is why you buy two, register both, and save one in a safe.

EDIT: I mean you can't copy credentials off in most cases, like this one. Credentials can be replaced.

If you program your own keys into the Yubi, then you know them and can archive them for reprogramming on another device. You can do this with the Yubi Personalisation tool [1] for a few modes the device supports.

[1] https://www.yubico.com/products/services-software/personaliz...

Eh. Hence why I said it like I did. In most cases, the device generates the secrets. And that's how it should be done, it guarantees that they can't be compromised easily (vs if someone compromised wherever you backed up those keys to).
Sure. There are also other instances where the Yubis keys maybe exposed, such as when using their OTP protocol which requires the keys stored in a validation server (either theirs by default, or your own [1])

[1] https://www.yubico.com/products/services-software/open-sourc...

Pretty much every online service that supports it has a backup 2FA method that you are required to set up. I use Google Authenticator on my phone because my phone doesn't have NFC.