Yubikey Authenticator
avc.mirror.xyz
avc.mirror.xyz
TOTP (and other) secrets will never come out of a Yubikey once they've been sent into it. And I like it that way.
It's not possible to clone yubikeys
https://support.yubico.com/hc/en-us/articles/360016614880-Ca...
Look at the "few exceptions" section
So one strategy for maintaining multiple authenticators or yubikeys would be to save all the secrets away and call them up when it's time to load up the alternate factor.
What I do is register both keys at the same time, one after the other so the QR code doesn't leave my screen. Can't do it this way if the one key is in cold storage, of course.
If you're referring to the Unix tool "dd" the answer is unambiguously no; zen_1 misunderstood you.
No data comes out of the Yubikey except answers to the cryptographic queries. There's no storage to dd.
The only way to clone secrets is to grab them before they go in and save them elsewhere. That's what we mean by "time of setup" or "time of programming" is when putting a new secret in, not like initial setup of the device.
I don't know why the author has so much trouble transferring 2FA. You take a picture of a QR code and it's all done for you. (This is also a good way to backup your tokens on a different device)
With that being said I love my yubikey and want to try this app.
Google Authenticator used to be much more secure. That is to say, it closely guarded all the secrets and they never left the app.
Unfortunately they had to bend to pressure of convenience for users, and that meant that now you can extract the secrets and push them around to your heart's content. That also means that an attacker can do likewise, or intercept them in transit, and so you lose the safety of a security key that is a "roach motel" for secrets.
I don't know about the author, but it seems there are still problems with secret portability. If your phone breaks, or it's stolen, and you have no access to the app, how're you going to export your secrets now?
The other cool thing about Yubikeys is that they're purpose-built, inexpensive, single-purpose. I don't want to be using my phone as a Swiss Army Knife authenticator. That's way too risky and dumb. It has a huge attack surface. Any malware could get at the phone. Plus all the risks of loss, breakage, or theft. A key can stay safe on my keyring and is "nearly indestructible" and it does only that one thing very well.
Many MFA implementations will not allow you to register more than 1 TOTP authenticator, and so that is why I typically use the trick of registering both Yubikeys simultaneously. If you wish to register another, the service will often require you to deactivate MFA and set it up from scratch, which de-registers the original one. I think this is probably mandatory, due to the way the secrets work. There's no way a service can safely store such a secret on-site, because this would defeat the purpose.
So in fact, if your alternate key/auth is offsite, then you're actually forced to manage your own secrets in order to properly register all affected devices.
You can have BitWarden or another password manager manage those secrets for you, but you've just reduced your MFA to 1FA, because obviously that's where you store your passwords. In fact, revealing a TOTP secret is more damaging than revealing a simple password. But, you do you...