All of you guys using a Yubikey, seriously, in production - do you have another one prepped, tested and sitting in a safe?
I just feel I have to look at the price, and order two, or it's just a toy.
I just feel I have to look at the price, and order two, or it's just a toy.
We decided though not to make our backup keys hot. It's a manual operation to enable it. The risk that everyone could simultaneously lose their key was lower than the risk of a backup key being lost and then used--since a person isn't likely to routinely check on their backup keys the later problem may go undetected for some time, whereas you know the day you lose your primary key and must report that situation anyway.
That gives me redundancy in case I accidentally dropped one in a blender or whatever. But also for anything high-criticality (basically anything where losing both yubikeys would lock me out permanently without further backups), I have another yubikey sitting physically-secured. It works out nice, since that's the same approach I was taking w/ "security question" answers and other recovery tokens.
All the services I'm using it on require some sort of backup 2FA method, so I simply use an authenticator app (that I have to use anyway since not all websites allow U2F keys) as a backup method.
Never managed far in messing around to use Yubikeys for GPG and SSH. It's nice and all, but U2F keys are useful without it as well.