Hacker News Reader

Comment by barryp | Hacker News Reader

Can you have more than one YubiKey associated with an AWS account? Or also setup TOTP, or have a set of backup codes in case you lost your hardware device? Seems kind of dangerous if you can only have one MFA method setup

View on HN

The Trezor [1] hardware device supports backing up (at initialization) and restoring of the secret seed which is quite useful. It can also be used as a password manager [2].

[1] https://blog.trezor.io/secure-two-factor-authentication-with... [2] https://trezor.io/passwords/

No. But you also couldn't have a TOTP + Hardware token previously to U2F introduction [1]. AWS has also never had backup codes to my knowledge, other than saving the secret key used to generate TOTP codes. The "backup" has always been maintaining access to the root account to allow that to reset 2FA as needed.

1: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti... ("You can enable one MFA device (of any kind) per root user or IAM user.")

That can't last (i.e., not more than one). The main reason being you can lose a key, forget it, have it stolen, break it, etc. Without a second you'll be living on the edge. They're gonna have to support more than one.

I have a Yubikey for my LastPass. I lived with a single key for over a year. I finally got two more. I'm not sure why I made myself so nervous / stressed those 12+ months.

I can't be sure without reading the docs, and I don't care to at the moment TBQH, but it may be possible to remove MFA via API keys for the account.

Reply on news.ycombinator.com