Hacker News Reader

Comment by NoZebra120vClip | Hacker News Reader

This is a good description of the Yubikey advantage. However, now that Authenticator apps are making it easier (and less secure) for you to move your secrets to new devices, this only underscores your need to register at least two Yubikeys in each place where you use TOTP, and don't forget those paper backup codes as well.

TOTP (and other) secrets will never come out of a Yubikey once they've been sent into it. And I like it that way.

View on HN

To avoid this 2:n issue, I make 2 yubikeys that are clones of each other, and leave one in a secure location at all times. The sites cant tell the difference apart from serial number

That's fine, but you can't keep them identical for long, because eventually you need to add/delete/update an account or a secret. So you're perpetually rotating that one in a secure location, and if your accounts have enough churn, it's a chore.

How do you make clones of a yubikey? Is this normal functionality I've missed or a hack?

Most likely they just mean that every time they register a new account, they get their backup yubikey out and add the account to it too

It's not possible to clone yubikeys

Can you dd one Yubikey to another?

At setup time, yes.

https://support.yubico.com/hc/en-us/articles/360016614880-Ca...

Look at the "few exceptions" section

If you grab a TOTP secret at setup time, you can do whatever you please with it, but this is of course extremely perilous, because access to the secret equals full control of that factor. The Yubikey's one-way storage is trying to save you from that danger.

So one strategy for maintaining multiple authenticators or yubikeys would be to save all the secrets away and call them up when it's time to load up the alternate factor.

What I do is register both keys at the same time, one after the other so the QR code doesn't leave my screen. Can't do it this way if the one key is in cold storage, of course.

> Can you dd one Yubikey to another?

If you're referring to the Unix tool "dd" the answer is unambiguously no; zen_1 misunderstood you.

No data comes out of the Yubikey except answers to the cryptographic queries. There's no storage to dd.

The only way to clone secrets is to grab them before they go in and save them elsewhere. That's what we mean by "time of setup" or "time of programming" is when putting a new secret in, not like initial setup of the device.

Yes that's what I meant

Reply on news.ycombinator.com