Can you clone or sync hardware keys? Maybe they don't fail as much as computers do but they can be lost or stolen like the keys that we use to open (dumb) doors.
My non hardware key is a keypass file that I update only on my laptop and I sync to my other devices. I have plenty of backups. It does also the TOTP required to login into some customers servers.
I have a few yubikeys and it’s a manual process to sync a new key last time I tried
I keep all my TOTP keys on an encrypted usb drive in a safe. When I lose a key, I manually add all the TOTP accounts onto the new key from my safe
Passkeys are a different story. Every account I need to make sure I have multiple yubikeys registered. When I lose one, I get in via a second key and then add the replacement one.
It’s a pain but it’s a model that makes sense to me. Lose the key? Time to reach for my backup key.
Comments
Yeah, that's why secure enclaves embedded in complex devices are a bad idea.
Hardware keys are the way:
- Less likely to fail in the first place
- Cheap enough to have several of so you can use one to log in and manage the others in the event of loss
- Easy to move between devices
- Less likely to use the auth handshake as a side channel for things you didn't consent to
Can you clone or sync hardware keys? Maybe they don't fail as much as computers do but they can be lost or stolen like the keys that we use to open (dumb) doors.
My non hardware key is a keypass file that I update only on my laptop and I sync to my other devices. I have plenty of backups. It does also the TOTP required to login into some customers servers.
I have a few yubikeys and it’s a manual process to sync a new key last time I tried
I keep all my TOTP keys on an encrypted usb drive in a safe. When I lose a key, I manually add all the TOTP accounts onto the new key from my safe
Passkeys are a different story. Every account I need to make sure I have multiple yubikeys registered. When I lose one, I get in via a second key and then add the replacement one.
It’s a pain but it’s a model that makes sense to me. Lose the key? Time to reach for my backup key.
Yeah it feels pretty dumb to have to register all of my keys with each service, but as far as I can tell it's the least dumb thing.