Google removed my Yubikeys from a Google account 'just to be safe'

1. You login with your key

2. Google flags you as suspicious

3. Google removes the keys from the account because the suspicious actor used them to login and could have been stolen

Therefore, unless you fall into one of these categories, you probably shouldn't use Google products - or, even worse, rely on it for sensitive things such as your emails, your photos or your work documents.

Yeah, in theory those recovery keys should still be secure, but you know for certain that a hostile attacker has the encrypted secure note, and without any confidence in lastpass it makes sense to change them as well.

Unfortunately this means you look exactly like someone doing an account takeover and changing the password and recovery keys on the account.

Right, that's likely the "bug" part. On HN of all places, people shouldn't be surprised that bugs happen.

The problem might be the business model itself. Google is not attached to any one of its billions of users, but they can cause a lot of pain if they randomly cut you off - especially in a world where email is essentially online identity. But then, I'd wager that a good 90% of us are employed in places that want to replicate that model at any cost... glass houses and all.

You don't go through the setup process on the sites again. The sites have no knowledge that you have 1 or 21 new totp apps set up. You just enter the saved seed keys into the app and it starts spitting out the same correct codes as the other apps you already had setup.

Gnome authenticator can export a json file containing the keys to all the sites you have in it. You can then take those (just manually read them in a text editor), and enter them into Google Authenticator on a phone, and now you have 2 working authenticator apps, both spitting out the same correct codes every 30 seconds.

Further, you take that same json and paste it into a note in a keepass record, or save the individual seed keys in individual site entries just like the passwords, and copy that keepass db file all over the place including cloud drives, and including places you can access without the totp.

Now you can reproduce a working authenticator from scratch on any device at any time no matter where you are and no matter what happens to your phone or laptop. Buy a brand new phone or laptop, have a way to get a copy of your keepass db without needing the totp app, and in a couple minutes you have a working totp app again.

You never really have to even use the single-use emergency bypass codes. Keeping copies of the initial setup seeds is really no different from keeping copies of the emergency codes, but the setup seeds reproduce a fully working app not just a one-time access to a site.

And even if some app doesn't provide an export like gnome authenticator, you can also just record the key the first time it is generated instead of just scanning the qr code. Once you've saved it, you can use it as many times as you want.

It's a nice thought, but overall computer literacy is still highly varied, and it likely will be for a very long time.

We still have a large percentage of users who use computers sparingly and by rote. I have family members who need a lot of help to do day to day setups and are going to have a hard time with MFA devices or apps.

"Other people could have an old phone registered as well if they don't want to buy a security key. It's a very minor hassle to set up and I can't see why people can't do it."

Minor hassle for you. Major hassle for a lot of users. Try real hard to put yourself in the place of a 77-year-old user who has limited sight and only needs to use a computer to accomplish very specific tasks - and has zero interest in doing more than basic email, banking, and a few other things that can only be done online. They have a smartphone only because it's a connection to their grandkids.

Because of the smartphone they're saddled with a Google or Apple ID that they'd otherwise never bother with. A TOTP app or YubiKey? That's well outside their comfort zone.

This isn't because these users are dumb. But the assumption that "it's time everyone learned" is based on the idea that everybody is using computers regularly and has resources for educating them - which is simply not true.

My kids, my wife, and my in-laws all use computers very differently than I do and it's extremely educational how people outside the industry see and use computers.

My 17-year-old only uses a Chromebook for school (grudgingly) and would rather do everything on their phone. My wife is fairly computer savvy, but still hits roadblocks. (She does enjoy forwarding me screenshots of particularly bad Phishing attempts...) And my older in-laws occupy most of their time far, far away from their computer. Singular.

Anyway - it'd be lovely if folks had way more empathy for the huge swaths of people who have less experience with computers. It's not the priority for them that you imagine that it should be.

Users are hard.

Now, I am not an expert on Yubikeys and the protocols used by these tokens, but I know they have protection against reply attacks meaning they keep the sequence number that is incremented for each challenge/response. Pretty sure it could be made to support multiple keys. It would be really nice if I was able to initialise multiple yubikeys and use them interchange-ably (and keep two in safe deposit box just in case).

It's hard to enforce that when there's no easy way to prove someone isn't in the country legally.

So they can plead ignorance.

REAL ID looks different and essentially proves that you are not undocumented.

Visually, there used to be no difference between ID for undocumented and documented, so you can travel freely. My immigration lawyer recommended against traveling to AZ with that ID.

Not sure what it changes in terms of hiring. Even with REAL ID after background check, I had to submit proof that I'm allowed to work in this country.

And then there’s the question of how the heck you scale this if you’re a new company and want to handle unlocks for global users.

Federalism in the US, a large section of the population that has no intent to travel outside the country, and general suspicion of the Government in a lot of states means that there is a patchwork of different IDs with different requirements, all of which are perfectly valid for their own jurisdiction. Real ID is just a way to set a basic standard for this kind of ID that will be required for (mostly interstate) air travel.

A better analogy for you might be a European ID. Get back to me when you can file taxes and access medical records anywhere in Europe using the same ID. (I half expect someone to pipe up saying that this is indeed possible and make me eat my words.)

Capitalism responded to market forces and the needs of the customer.

Why make it easy for our customers to contact us (presumably to make a claim - ie the whole reason insurance products exist) when we can just pretend it's easy, collect money based on that lie and get away with it?

Outstanding customer support would entail expense, threatening profits. The money of happy and unhappy customers turns out to be the same color.