Hacker News Reader

Comment by lars_francke | Hacker News Reader

I've recently tried switching to YubiKeys to store all my 2FA tokens and only later learned that they have a hard limit of 32 stored tokens.

Does anyone know of an alternative hardware token that supports more than that and also all the other protocols that YubiKeys do?

View on HN

I consider myself a highly technical person, and I don't have anywhere near 32 services that support OTP. I think for most people 32 is currently enough. It would be nice if it were a bigger number, how much space could it possibly take to store the secret and label?

I just migrated from LastPass to Bitwarden and took the opportunity to delete old accounts and enable 2FA or WebAuth or whatever else was available everywhere it is supported.

I'm working my way through the list aphabetically and at "Jetbrains" I reached 32.

This is over ten years worth of accounts. I'm sure I'll reach 50-60 before the end.

Why can't yubikey use a single root secret and derive all sub-secrets from that root secret?

They should be doing that. Maybe the OP means the limitations on passwordless credentials and not u2f credentials.

I might get the terminology wrong. What I meant are the HOTP and TOTP secrets. They can only store 32 of them.

This is what I'm referring to https://support.yubico.com/support/solutions/articles/150000...

Because usually the server sends the shared secret and there are just 32 slots for shared secrets available.

Yubikey and webauthn[0] supports public key authentication where the client chooses the secret.

[0]: https://webauthn.io/

Yes but that's a whole different 2FA implementation, where sites must support U2F (webauthn). Unfortunately, the implementation of TOTP is far more common than U2F.

Ideally all sites will implement U2F as two factor authentication, but there aren't that many users who have a U2F compatible token. The reach of TOTP is far more beyond U2F, which is probably why sites use TOTP more than U2F.

When sites offer both, choose U2F. When sites offer TOTP only, use it. It is better than nothing. When you have a yubikey already, use the Yubico authenticator app to store the TOTP secret to make your TOTP attack surface less and to have the availability to change your phone without losing TOTP secrets.

>When sites offer both, choose U2F. When sites offer TOTP only, use it.

This, 100%

In some sense TOTP, basically HMAC, seems like it would be harder to screw up than a public key system. RSA is amazingly hard to get right. I wonder if the order of preference should be:

1. U2F ECDSA/EdDSA

2. TOTP

3. U2F RSA ... Infinity. SMS 2FA

No idea where ECDAA [0] fits.

[0]: https://paragonie.com/blog/2018/08/security-concerns-surroun...

Reply on news.ycombinator.com