Hacker News Reader

Comment by ryanklee | Hacker News Reader

I've tried multiple times to work YubiKeys into my workflow and failed each time. The key needs to be with me all the time from room to room, building to building, location to location, not get lost, from change of clothes to change of clothes, and not end up in the laundry, and this is hard, hard, hard.

Who has managed to do this successfully and without losing their minds?

I hate passwords and would love to complement them with better security factors than my phone alone or find a way to move away from them entirely, but YubiKeys et al do not seem consumer viable to me. And I've tried.

View on HN

I just leave it on my keyring.

Do you have a code to enter your building or something?

I don't need my YubiKey just at work. I need it with me all the time regardless of whether I am even wearing clothes.

OK, I'll bite, where are you logging in naked? Some eyes wide shut situation?

Because in my day to day life wearing clothes is not a prerequisite for interacting with technology. I frequently exercise. This requires many showers and many changes of clothes. I walk around in the morning just wearing my boxers for the first hour of the day or the last hour of the night. This isn't exactly abnormal behavior. I always have my phone around but always having my phone plus always having my YubiKey is a step up in difficulty and not a linear one. Any successful auth solution better be prepared to solve such behavioral issues or they won't ever reach sufficient adoption levels.

You could put it on a chain around your neck. I don't know the specifics of your situation if that's feasible. Also how often do you have to use 2FA? I've been using hardware keys for a few years. I have one plugged into my dock and one in my backpack. Which seems to be enough. So far I haven't been caught off guard.

> This isn't exactly abnormal behavior

The exercise and showers maybe, but feeling like you need your yubikey with you literally 24 hours a day certainly is. I use them extensively and with everything properly set up perhaps need it a couple of times a week at best. Having it on a keychain or in a backpack is fine.

Hate to say "you're doing it wrong" but you (or your company) certainly seem to be doing something wrong to have this level of hassle. No-one would use them if they were this much trouble.

Certainly interested in hearing what I might be doing wrong.

Maybe this is a cultural difference but I can't imagine why I would need to sign into something while naked.

Please see my reply to sibling comment.

I have one on my keychain, one in each computer and one in a safe

And you enroll them all for each service?

Yes. It's not super fun, but I only need to do it once per service.

I even built a Solo 2 key into my framework laptop:

https://imgz.org/i6Gn2fyS/

That's incredible. I can't imagine the Framework people ever thought of this particular extension card use case.

I wonder if something like this could sell on their third-party extension card store.

Maybe they didn't think of it, but they certainly made it happen! The fact that they provide customizable 3D-printable models in a GitHub repo is fantastic, I love the laptop and the company.

I don't really want to bother selling it, but I'll upload it to Printables in case anyone wants it.

But what are your steps if you loose device1? Log into each service with device2 and unenroll device1’s key?

Yes, or, more likely, just do nothing because it needs a PIN that nobody else has.

Yes, for each important service. Primary email, financial, dns, etc. others I user long random passwords.

Do you need it on every login? Isn't it like every other 2FA where you can choose "remember this device" or something like that?

Reply on news.ycombinator.com