Hacker News new | ask | show | jobs
by ahnick 1954 days ago
Some devices derive their keys from a recovery seed that you can store offline in paper form. The benefit of this approach is that you can recreate the key on a backup device using the recovery seed, should you lose your primary.
1 comments

Ah, neat, so basically the recovery seed would let you buy a new device and then use it to "clone" your old one?

Definitely useful in case you lose it or it gets stolen, but you'd end up wanting to rotate to a new key with fresh seeds anyway, since the old key could be in the hands of an attacker. I guess this is still useful in the case where you don't lose the old key, but instead damage or destroy it by accident.

Yes, exactly. If you lose it or it's stolen, then you'd want to rotate to a new key quickly. Some of these devices have a pin too, so the attacker needs to crack the pin before they can actually use the device. This should hopefully buy you enough time to bring up a new device and switch over accounts. That's why it's probably a good idea to buy your second device when you buy your first one and store it in a separate, reasonably secure, but more importantly, quickly accessible, location.