Hacker News Reader

Comment by BoppreH | Hacker News Reader

I really dislike the spare key solution. It forces users to either carry both keys with them all the time (and risk losing them together), or introduces massive friction into the account creation (have to fetch the spare key from whatever safe or friends house you store it in).

I don't understand why better solutions are not considered. Why not derive keys deterministically, so that you only have to backup the seed (a lá SQRL)? Or encrypt the new account with a public key, and store the private key in a safe.

To me, "use a spare key" is on the same level of unpractical advice as "just memorize long unique passwords".

View on HN

What I really want is duplicate keys. I should be able to order a set of 2-3 Yubikeys that are identical.

It's getting better, but for a long time the majority of places that supported hardware keys only supported adding one. Places that support multiple keys are better, but they require that I go through the "add a key" process twice and that I be at home (or wherever I store my second key) in order to add it.

If I had one key on me and one identical key at home. Losing a key still means I can't log in until I retrieve my spare key, and I should replace the set, but it's a much better situation than having a single key and roughly no worse than losing one of two unique keys.

my solution is a combination of all of these things:

- I have three yubikeys — one at home, one on keychain, and one backup

- I have three accounts that are secured by these yubikeys: my email, my password manager, and my Apple ID. these are the core accounts that are Game Over if access is compromised or removed to/from all three.

- for these three accounts I have recovery codes printed

- the recovery codes and the backup yubikey are stored in a safe deposit box at my bank

- for literally everything else I use my password manager (1Password) with its built in 2FA

the idea is, anything other than those three accounts getting compromised is not a risk since they all have unique email address (Fastmail masked emails) and passwords. software 2FA is Good Enough since it is backed by hardware 2FA for my password manager. and if I lose access to one of those three core accounts, I should be able to finagle my way back in.

since I'm not adding hardware 2FA to new accounts, I don't need readily available access to all yubikeys at once.

as soon as passkeys are pervasive I will generate and store them from 1Password.

this lets me have relative convenience in a majority of scenarios with focus on reducing risk of being totally fucked out of everything. it's obviously too much for a normal person, but for a professional in tech, I find it appropriate for my threat model/risk tolerance

I have 3 keys. One on my keychain in my pocket, on in my bagpack, on at home. The chance of loosing all of them are really slim.

> The chance of loosing all of them are really slim.

True, but you sacrificed some safety for that. If you're not home, you can only create accounts protected by the keys in your person, and you're one robber (or fall into a pool) away from losing those accounts.

I'd never accept a password manager with such limited sync, and those are usually free. Paying for three hardware keys and still having such limitations is beyond me.

I'm all for hardware keys, and I'd love to use them to replace all my passwords, but I still wouldn't call your setup "adequate" in terms of either cost, friction, or safety.

How often do you create new accounts at FIDO-supporting sites? You must have a different internet usage model than I do.

You can also add the additional keys later. If it's a serious enough account to be protecting with hardware keys, and you only have a couple keys with you, add a note in your password manager to remind you to add your other FIDO keys. You could add that note to the username so you can't login without editing the username and acknowledging it.

It sounds like a non-issue you're turning into a hypothetical concern because... I don't know, you don't like paying a quite modest amount of money for increased security?

Falling into some water won't brick a yubikey anyway.

> How often do you create new accounts at FIDO-supporting sites? You must have a different internet usage model than I do.

It’s introducing one more frustrating make-work item for the human. Now I have to remember to enroll all my keys at all the sites I’ve used them for. Totally manual. Totally forgettable.

These keys should act like HSMs and have proper backup and restore. Even if it locked me into a specific key manufacturer (like lost HSM backup/restore functionality does) I’d take that over the idiotic “just have multiple keys and manage keeping them all enrolled manually” story.

Probably the most important feature of hardware tokens is they can't be copied.

Any backup is a copy.

No. The backups have their own secrets and no relationship to one another. You register them as distinct keys with each app.

Here's an example of what I consider a reasonable hardware key security model:

I can initialize a Nitrokey HSM on a disconnected PC with whatever device key encryption key (DKEK) I want (128-bit AES key). I can write that key down and store it in a safe place (broken into chunks, if need be, for my security model). I can backup my keys generated by the Nitrokey to export files that are completely useless w/o my DKEK. I can store those backups wherever I want without any loss of security.

If I lose my Nitrokey device I can buy another, initialize it with the same DKEK, and restore my key backups. (If I really want to I can decrypt my backups using my DKEK.)

If I don’t want to do any of that I can have the Nitrokey generate a random DKEK that is never exposed. Then I lose all my keys permanently when I lose the key. I have the option to choose the model that allows me to backup my keys if I want to.

If the point of the hardware key is to put the owner thru pointless make-work and risk then the hardware key is serving somebody other than the owner.

I also use a password manager. Yukikeys are a poor choice for authentication despite what the article says.

But they are good for 2FA, which is what I need them for to mitigate the risk of phishing, siphoning credentials from my phone or just stupidity on my part.

A robber would still need the password so I'm safe for my threat model, which doesn't include state actors.

But you are right about one thing: adding those keys to all the important account, and adding a new one when you lose one, is a pain in the butt.

> If you're not home, you can only create accounts protected by the keys in your person

I'm not often creating many accounts away from home, and I'm not often then away from home for long periods of time where this matters. I'm also just not often creating that many accounts.

If I'm out someplace and I need to create an account but don't have all my authenticators, I'll either just go without 2FA for that brief period of time or just go with the authenticators I have with me. Then when I'm home (probably within a few hours) I'll add those extra authenticators.

Iirc, the Ledger crypto-wallet supports FIDO2 based on your backed-up seed.

There’s no need to carry both keys. Leave one in a secure location. Carry the other.

Reply on news.ycombinator.com