Hacker News Reader

Comment by anilakar | Hacker News Reader

There's still one huge disadvantage with hardware-based FIDO U2F tokens: There's no good way to migrate from one to another. I've got three(!) Yubikeys of different generations on my keyring because I'm not sure whether I have enrolled the two newer ones to all the services I'm using.

View on HN

The absolute dream is to have a single nonprofit OAuth identity provider against which people can prove their identities with FIDO U2F, then use the issued tokens to auth with services of their choosing. Building this network is incredibly hard, though (what website would accept an identity provider without any users, and what users would use an identity provider not accepted by any websites?) so the most popular implementations are hosted by Google or Facebook - but there you have all the obvious privacy issues.

This is something I'm trying to simplify with my product. The foundational security features of U2F (you can't interrogate the device to find out what other services are set up) make it basically impossible to migrate them to new devices, but all the other capabilities of the Yubikeys can be moved across.

This is really why U2F falls over in the Enterprise, at least from what I've seen. Customers want centralised management, but the U2F protocol just can't support that.

It's too late for you, but: create Google doc. Add service to list when enrolling. When you get a new key, consult list.

I use 1Password as my password manager, and add a tag to each login where I have a specific hardware key registered.

Reply on news.ycombinator.com