21–30 of 65 posts
Earlier quoted context omitted.
One thing to keep in mind before buying their NFC keys is that it can only store up to 10 resident keys
Yubikey 5 can only store 20, which isn't a whole lot better. Are there yet any readily available FIDO devices that can store 100s of resident keys (I have almost 400 logins in bitwarden)?
I have a couple v1 Solokey Somus lying about. Good little devices. Unfortunately the main selling point of upgradeable firmware is moot if they no longer support the old devices and you have to upgrade. At that point it's they're like everyone else. Except they require some setup on some machines, whereas other keys "just work" I've since replaced them with yubikeys. Yubikeys have a better feature set (at least compa…
apt-get install solo-python
As much as I want a hardware key, I still struggle with the practicality of having a backup key. I create new accounts on websites quite often, and the idea of having to go fetch my backup key out of a safe to register it (and hope the site allows multiple keys) just feels impractical (“I’ll do it tomorrow”). Not to mention—what if I’m at work, or out and about setting it up on my phone? Am I really going to remember…
An alternative some people use is to register a TOTP code and print out the QR code. Then you can remove it from the app. It's not a full solution but it might be part of one that works for you.
> Wish there were a way around this :/
Sign in with Google/Facebook/Github. I wish sites supported custom OIDC but that's probably impractical.
As much as I want a hardware key, I still struggle with the practicality of having a backup key. I create new accounts on websites quite often, and the idea of having to go fetch my backup key out of a safe to register it (and hope the site allows multiple keys) just feels impractical (“I’ll do it tomorrow”). Not to mention—what if I’m at work, or out and about setting it up on my phone? Am I really going to remember…
Intuitively it seems like it should be possible for me to store on my main auth device some form of the backup device’s identity or public key material, and at enrollment time, ask the authenticating service to trust either the current device or also this other device to authenticate me.
I wonder what risks I’m overlooking-surely there must be good reasons the protocol excludes that kind of approach.
As much as I want a hardware key, I still struggle with the practicality of having a backup key. I create new accounts on websites quite often, and the idea of having to go fetch my backup key out of a safe to register it (and hope the site allows multiple keys) just feels impractical (“I’ll do it tomorrow”). Not to mention—what if I’m at work, or out and about setting it up on my phone? Am I really going to remember…
What do you imagine a solution here might look like? I don’t know enough about the problem space to truly know, but I feel like I’ve seen versions of this: I can authorize any arbitrary public key for use over SSH, for example; and (based on my memory of YubiOTP) it’s seemed like at least some of these hardware auth protocols work based on using an open serial number or public key to identify the authorized authentic…
Keys with lots of feature have a larger code base and this means more bugs in the long term.
I use my FIDO2 keys for proxmox, ssh ed25519-sk, vaultwarden, nextcloud, GAFAM accounts.
Unfortunately I know of no bank that has adopted FIDO2/webauthn.
Note: Paypal only allows one FIDO2 key AFAIK, so not an option there.
What a wet dream for the internet controlling fascists when the adoption of "just wield your smart phone" auth would be in place and mandated every where.
Nothing compares to the secrecy of passwords.
After looking at various keys and their features I chose basic FIDO2 with NFC with no storage or other fancy feature. Keys with lots of feature have a larger code base and this means more bugs in the long term. I use my FIDO2 keys for proxmox, ssh ed25519-sk, vaultwarden, nextcloud, GAFAM accounts. Unfortunately I know of no bank that has adopted FIDO2/webauthn. Note: Paypal only allows one FIDO2 key AFAIK, so not an…
I wish there was stronger laws forcing banks to adopt stuff like that.
As much as I want a hardware key, I still struggle with the practicality of having a backup key. I create new accounts on websites quite often, and the idea of having to go fetch my backup key out of a safe to register it (and hope the site allows multiple keys) just feels impractical (“I’ll do it tomorrow”). Not to mention—what if I’m at work, or out and about setting it up on my phone? Am I really going to remember…
I currently have four Yubikeys: one on my keychain, one in my apartment, one to take with me while traveling, and one at my parents' house. I figure this should be adequate to ensure I never get locked out of Bitwarden or Google, which would be an utter disaster.
Am i the only one concerned about the tendency of putting your identity on hardware you possibly do not own? What a wet dream for the internet controlling fascists when the adoption of "just wield your smart phone" auth would be in place and mandated every where. Nothing compares to the secrecy of passwords.