Hacker News new | ask | show | jobs
by insomniacity 3082 days ago
All of you guys using a Yubikey, seriously, in production - do you have another one prepped, tested and sitting in a safe?

I just feel I have to look at the price, and order two, or it's just a toy.

5 comments

We use Yubikey for our production systems and yes: every operator has two keys that have been configured and registered in our access database.

We decided though not to make our backup keys hot. It's a manual operation to enable it. The risk that everyone could simultaneously lose their key was lower than the risk of a backup key being lost and then used--since a person isn't likely to routinely check on their backup keys the later problem may go undetected for some time, whereas you know the day you lose your primary key and must report that situation anyway.

My Yubikey is provisioned with a SSH key generated on an air gaped laptop running Tails OS (live cd). The master key and subkeys were then saved on a separate encrypted SD card at the same time for backup.
Sortof. In practice, I have 2 "live" yubikeys per purpose, since I want a USB-A and USB-C set depending on whether my computer is plugged in to the hub on my desk or mobile.

That gives me redundancy in case I accidentally dropped one in a blender or whatever. But also for anything high-criticality (basically anything where losing both yubikeys would lock me out permanently without further backups), I have another yubikey sitting physically-secured. It works out nice, since that's the same approach I was taking w/ "security question" answers and other recovery tokens.

I don't.

All the services I'm using it on require some sort of backup 2FA method, so I simply use an authenticator app (that I have to use anyway since not all websites allow U2F keys) as a backup method.

Never managed far in messing around to use Yubikeys for GPG and SSH. It's nice and all, but U2F keys are useful without it as well.

You can generate the keys on a Raspberry Pi or similar, transfer them to the Yubikey, and keep the backup in a safe place.