Hacker News Reader

Comment by kwanbix | Hacker News Reader

What happens if a Yubikey breaks?

From the article:

> Nowadays, newly-onboarded Discord corporate users receive a laptop and at least one Yubikey alongside that laptop. IT onboards users to Okta and instructs them to register at least two WebAuthn authenticators; typically, this is their Macbook’s TouchID/Windows Hello sensor and also their Security Key C NFC.

> We also instruct corporate users to set up Okta Verify for use only as a fallback MFA in the event that all their authenticators fail at once. This way, we never have user accounts lacking at least one strong form of multi-factor authentication.

So OS level keys, a yubikey for roaming, and Okta Verify for fallback

In addition, Okta Admins can also recover accounts, so loss of the Yubi doesn't mean the account is locked out forever. You can easily provision a different 2FA method.

When we deployed we banned Verify (didn't want any OTP), but encouraged TouchID, and the Yubi. If someone was locked out we could temporarily enable Verify, or reset their Macbook or Okta access so they could reregister into either.

But,in deploying 1500 or so yubikeys over a 5+ year period we never saw one actually break. Employees would often say they'd broken, but troubleshooting normally was user error.

The worst we saw were a few cases where Yubis needed unplugging and replugging (sometimes being left out for an hour or so).

Lots of good answers, but the ultimate point is that you can lose work time, and that is an accepted part of the trade off. If I lose my Yubikey(s) my employer will pay me to wait until a replacement arrives because the security is worth that cost.

So first of all: From my experience, Yubikeys are incredibly durable. I have one on a keychain for years now, completely beaten up and it's still working fine.

If a Yubikey gets lost: on all our internal systems, an administrator will remove that Yubikey from the user's account and a new Yubikey is deployed. For a remote employee, we can usually switch to OTP until the new key arrives. For external systems, it is the responsibility of the employees to securely store their recovery keys. If these are gone, well then it depends on the service how tedious it will be to reset the 2FA for that account... it usually (and hopefully) involves some kind of manual identity verification process.

Some people in critical positions simply get two Yubikeys.

>Some people in critical positions simply get two Yubikeys

That really seems like the way to go for everyone, because of course when you lose access to the yubikey, it's suddenly far more challenging to get support via systems you may no longer be able to access. Google insists on two hardware MFA tokens for their elevated account protection program, most likely for this reason.

I agree, but for some reason the people responsible for the IT budget did not like that solution... (Yes, they are really not that expensive, but somehow it is pretty common that companies like to cheap out on the small stuff).

I've destroyed two yubikeys in a 2017 MBP that would occasionally send excess voltage out of USB (I guess it was a bugged first-generation USB-C chipset), and one from leaving in on my keyring in my pocket in the laundry.

It's possible to break, but it's not trivial.

Wow I thought I was the only one - fried a Yubikey and a Logitech webcam because I forgot I plugged it into the “cursed” port. Took a bit to convince IT to req me a new laptop.

You use out of band non yubi key mfa and contact your support and they give you a new one. Been using them for a while it’s really not too much of a challenge.

Also you just keep a bucket of non signed up ones at the office. Enrolling them is pretty easy.

Same thing that happens if you forget your company login password.

You always issue 2

Do you though?

It’s been my understanding that for corporate use, only a single one should be issued because:

1: There’s an establish support team in your org that can always issue a new one (except for a few edge cases, super critical things) 2: You can’t trust users with 2 devices

For private use, nr. 1 would not be true so the recommendation rightly is to issue 2.

Your manager holds your backup.

If you're their number two, possibly you hold theirs.

I've never heard of this practice and would throw the book at anyone who implemented it in a shop I worked at.

You keep both your keys, one securely and one at-the-ready.

This is fair, but I have to note, a little out of date for startups which can be 100% remote to the point of founders not having a home city, let alone one stable, secure place to stash a backup.

Yes, safety deposit boxes. Yes, family, yes friends. Yes, attorneys.

But also what I said initially.

At Google the IT desk had a jar of Yubikey. You could just take and enroll however many you wanted.

Google was one of the earliest adopters of Yubikeys, and they used them for EVERYTHING. When I worked there, we always received 2 keys: one of those itty bitty ones that sits in your USB port permanently, and a regular key that fit into our security badge holder, or you could keep at home, or whatever. The switch to security keys reduced account takeovers to 0:

https://krebsonsecurity.com/2018/07/google-security-keys-neu...

I have four. One attached to the desktop, one attached to the laptop, and two carried with all my mechanical keys (one of them supports NFC and another supports USB-C).

glutton ;-p

And if you somehow get locked out you can show up at the help desk in person, or VC in with your manager on the call to Id you

I've not heard an argument before for why a user cannot be trusted with 2 keys

It depends on where you work.

I’ve supported users who would eBay the second one, if they were smart enough to do that.

But is an engineers time not worth more than an additional key users can do self service with? Seems like a really thin argument given how cheap the keys can be.

How often do yubikeys break?

I’ve got one of the original ones (15 years old?) the must have been through the wash a dozen times and it still works.

Same. These things are indestructible. LOSING a key, however, is totally in the cards.

On the veeeery bottom of my to-do list has been to get a 2nd yubikey in case mine breaks....

9 years later I'm still procrastinating and after reading these comments I'm convinced I'm good for another couple years LOL

I did have a nano though, it broke on me, but it was my company's key. I don't think the same holds for those ones.

Take care. Github and Yubico revoked some yubikeys in 2019.

https://www.zdnet.com/article/yubico-to-replace-vulnerable-y...

Reply on news.ycombinator.com