How to Yubikey

> With security key if you lose it you lose access immediately to your stuff and you probably can not get a new one with in 24 hours even if money wasn't an issue.

If you lose it while traveling and have a backup at home you can likely have someone overnight the backup to you in pretty close to 24h. You also only lose access to stuff that requires the key every time you access it, all but the most sensitive services will keep you logged in without the key for a period of time.

> Wallet is the best example. If you lose your wallet you need to kill your credit cards and get a new ID. However this does not lock you out of anything. You can go to your bank and take out whatever amount of money you need

In the US at least you’ll find the bank wants to see your ID to let you withdraw cash, and businesses are becoming less friendly to paying cash. Though, like a security key, many people have a spare id at home in the form of a passport.

> The attack surface of yubikey vs a laptop you carry around is interesting.

If you use the term "Yubikey" to describe the simplest model of Yubikey and not as a generic term to describe these security keys. Both Yubikey and their competitors are offering more advanced models: models which aren't simply unlocked by a tap on the device.

Then the attack surface compared to a laptop you carry around certainly becomes very interesting.

The security key I use most (I've got several models) have their own tiny screen and are protected by a PIN and won't work anymore after three wrong PINs (and let's not shift the goalpost by discussing what happens if you forget your PIN, that's another subject).

A friend of mine and his colleagues, sysadmins at a major ISP, all use "OnlyKey". They're protected by a PIN too (no screen but six digits on the security key). One PIN to register the security key, another PIN to auth.

Then there are security keys, including Yubikeys, only unlocked by fingerprints: now we're talking about Ethan Hawke stealing your laptop, your security key and recreating your fingerprints from a glass he stole at the bar (it's not impossible, but we're very far from "we stole your laptop while the session was unlocked").

> like a rubberducky or teensy flashed with some malware installing HID emulator.

Wait, what would a teensy used for nefarious purposes do here? You can't sniff what's inside the Yubikey. It's kinda the whole point: it's a challenge/response only answered by knowing a secret protected by the HSM on the Yubikey. There's nothing to sniff. If you didn't intercept and modify the key while the person registered on a service, you'll never be able to auth without unlocking the actual key which was used to register to the service. You may be able to sniff and relay the auth but you'd still not be able to extract the secret out of the security key.

> Because if not then all that added layer of secure feelings is pointless from an operational security perspective

I don't know: all the big security hacks we saw recently would all been stopped cold dead in their tracks had U2F/webauthn been used (like the, supposedly, Plex related on where one dev had a years old, compromised, version of Plex which was used to exploit his home computer, which then allowed to get inside the company's network for all was needed to log in to the company's network was to sniff a password).

Google reports there have been zero break ins since years, since when they moved all their employees to mandatory U2F (then switched to webauthn and I take it now to passkeys?).

I'm overall confused by your comment... What kind of attacks are you exactly talking about? Someone stealing your laptop then installing a teensy in your laptop and putting the laptop back in place, without you noticing? Or just someone stealing your laptop while the Yubikey is in it?

Are you actually saying that because some Yubikey aren't protected by a PIN and because some people leave this model of Yubikey in their laptop at all times, all security keys don't offer any additional protection compared to a laptop being stolen?

Other than Google Titan and Yubikey, are those really the only two players? I find it concerning that there is this whole ecosystem built around security keys, but only two companies making them. That said I currently use yubikeys for all my stuff, it just occurred to me its odd there isn't a bunch of companies making these :/

> I really would like to use it, but without ability to backup it

I totally know the feeling. I was there, I don't believe for a second that enrolling another key is an acceptable option and I solved that problem in a way that works for me.

You can clone your own security key if you're willing to deal with the problem that now becomes: "How do I safely store the secret allowing to restore another security key?".

I'm using paper seeds, split over several countries. A $5 wrench attack on my mom to have her open her safe won't be sufficient. The attacker would need to $5 wrench another half too, which my mom doesn't have.

Ledger Nano S (supposedly a cryptocurrency hardware wallet but I only care about the U2F support) has a U2F "nano app" installable on the key which shall do U2F (and webauthn, which is backward compatible from the device's point of view... It's not clear to me if it's going to work as a "passkey" too or not). They cost $79 or something.

They're using these kind of secure chips from STMicroelectronics: https://www.st.com/en/secure-mcus/st31h320.html

Ledger kinda knows what they're doing: their CTO was part of the original FIDO spec group.

Buy two of them, initialize them with the same seed. Make sure to secure your paper seed.

In my case the issue of "cloning and backuping a U2F/webauthn key" is solved. But it's a trade off: now I have to deal with storing the paper seed allowing to restore the U2F key.

In exchange for that hassle I get U2F everywhere (SSH being a big, big, big one) and my security keys are protected by a PIN (three wrong PINs and they reset to factory default). And I don't leave with the constant fear of losing my security key and being locked out of all my services / having to reset everything.

As an added bonus that Ledger Nano S has a tiny device telling you if you're registering or authenticating and it's telling you where you're registering/authenticating. It becomes very hard to trick you into registering/authenticating to a bad party.

Also for me to be really in trouble I'd need to both lose the ability to restore/clone another key and I'd need to lose access to the two security keys that are configured with the same seed.

That is highly unlikely.

The 32 TOTP limit was what killed it for me as a replacement for Authy/Google Authenticator/etc. I know Yubikey came out before TOTP really hit its stride, but 32 was really short-sighted.