Comment by diggernet | Hacker News Reader

Comment by diggernet | Hacker News Reader

Parent Full thread

I've been troubled by that question too. Especially since I've heard people complain about sites that only allow registering one key. But TacticalCoder just said something really interesting in another part of this conversation:

> you can use the Ledger Nano S with your "seed" (say a 256-bit secret, stored as 24 words you hide), to log in sites using U2F. > Additionally as long as you've got your secret, you can reinitialize your Nano S (or another one) as a new U2F device and there's no need to reset your U2F credentials on the site as the newly initialized device shall work exactly as if it was the old one.

If I read that right, some keys rather than having a hardcoded unique seed, will let you set your own. Which implies you can have multiple functionally-identical backup keys locked up securely somewhere. If true, that significantly reduces key loss anxiety, and increases my interest in hardware MFA.

Anyone know which keys support this (aside from the mentioned Nano S and Trezor)? What's the magic keyword to look for in specs?

> If I read that right, some keys rather than having a hardcoded unique seed, will let you set your own.

Set your own or generate one for you, using an hardware CSPRNG, and then let you write it down in a convenient way (24 words out of a dictionary of 2048 words, so 264 bits: 256 bits of entropy plus 8 bits of checksum. Heck, you can use 12 or 18 words too. I think the (BIP39 / BIP44) standard even allows for 15 words but Ledger does only support lists of 12/18 and 24 words although don't quote me on that).

> Which implies you can have multiple functionally-identical backup keys locked up securely somewhere.

I don't even bother having multiple devices ready to use. I simply store the seed (once again: as a list of 12/18 or 24 words) on a sheet of paper and I store this in vaults/safes.

> Anyone know which keys support this (aside from the mentioned Nano S and Trezor)? What's the magic keyword to look for in specs?

I've got a Ledger Nano S only for this. It's really a nice little device. I don't work for Ledger btw! They're a bit pricey but, indeed, the anxiety of getting locked out of your account or having through crazy procedures goes away.

It's a pricey little device but not that crazy expensive: about 60 USD I think.

> What's the magic keyword to look for in specs?

I don't know but the U2F "nano app" does work with Google and other sites and I know that Ledger is working on the more recent Webauthn support.

https://www.yubico.com/support/download/yubikey-personalizat...

you can do a lot with a yubikey but idk if you can actually change the U2F secret

You can tell the device you want a new random secret (so now your existing credentials don't work), but you can't get the secret out (obviously bad guys would use that, so it would be a terrible idea) neither can you set the current one to an explicit value.

So you can set the current one at the start of your use and keep the secret hidden somewhere forever. Sounds like the solution to me.

Evidently the way I wrote this previously wasn't clear enough, so I have attempted to improve this text.

No, you can have a random new value (effectively like you bought a different one), but you won't learn what that is, so it doesn't help you and there's no way to "keep the secret hidden somewhere" except in the sense that it's hidden inside the device where it belongs.

You definitely can initialize Yubikey OATH-TOTP with a known value in order to have multiple devices with identical secrets. I have done that, also see https://support.yubico.com/hc/en-us/articles/360016614880-Ca...

Reply on news.ycombinator.com