Hacker News Reader

Comment by philip1209 | Hacker News Reader

I'm hesitant to rely on security keys after two of my Yubikey 5cs broke in the same month after ~3 years of ownership. Do we understand the lifetimes and and stability of these devices?

I think hardware security make a ton of sense for an enterprise environment, where you can go to IT and prove your identity to regain access. But, for something like Apple or Google - I'm sure the recovery process is not as easy.

For a hardware crypto wallets, people go to extremes - safety deposit boxes, fire-proof recovery phrases, etc. But, for me - losing access to my core online accounts would be more destabilizing than losing money on a hardware wallet. Yet, we don't have the ultra-reliable backup methods in place for web auth like we do for crypto wallets.

View on HN

The security key here isn’t used for every login. So if you were to lose both it’s not like your account is completely disabled and all data lost. I think you can even use still use your Recovery Code.

The Security Key here primarily replaces the 2FA authentication method for adding new devices to your account.

From Apple’s own documentation:

When you use Security Keys for Apple ID, you need a trusted device or a security key to:

- Sign in with your Apple ID on a new device or on the web

- Reset your Apple ID password or unlock your Apple ID

- Add additional security keys or remove a security key

I believe if you lose both you can still add another as long as you have access to a device that’s still logged in.

The biggest hole in Apple’s security model, and one which has been documented to have been exploited many times, is people using phishing tactics to get the 6-digit 2FA code to gain iCloud access, adding a new device, then downloading the unencrypted backup from the victims primary device from iCloud. Security Keys and E2EE now make this impossible.

> I'm sure the recovery process is not as easy.

A lot of services offer one-time backup codes and connecting multiple 2FA devices. Making Yubikey a single point of failure is certainly a bad idea.

I deployed 1000+ over 3+ years, and never had one break. It’s anecdata and I believe they can fail, but we never saw it once.

Using the A and C nanos. Helped they were permanently in machines though. No mechanical risk.

Wow, that's a bit scary to hear about. Maybe have 3 and test them monthly on a rotating basis.

How did you end up recovering when your Yubikeys broke?

You usually have some kind of backup codes when you set up a second factor auth

I didn't. I smashed them with a hammer and replaced them with new ones!

Reply on news.ycombinator.com