News for hackers. Stuff that matters.
Re:OnlyKey: Open-Source Alternative to YubiKey by fauigerzigerk on Thursday December 26, 2019 @03:25PM (#21886443)
All depending on the discretion of the various services. Of all the services that force me to use 2FA only a tiny minority provides recovery codes.
Re:OnlyKey: Open-Source Alternative to YubiKey by idlewords on Thursday December 26, 2019 @03:29PM (#21886467)
What services allow U2F security keys but don't provide single-use recovery codes as backup?
Re:OnlyKey: Open-Source Alternative to YubiKey by fauigerzigerk on Thursday December 26, 2019 @03:36PM (#21886540)
I don't know about U2F specifically, but recovery codes are not generally a feature of 2FA.

Edit: And let me just add why I think this is relevant. Even though few people have dedicated hardware keys today, many 2FA schemes depend on being in possession of a particular phone. There are typically no backups and no recovery codes.

I don't think this would necessarily change if specialised key hardware was used more often. In fact, my business bank account and a broker I previously used both require hardware keys and do not provide recovery codes.

Re:OnlyKey: Open-Source Alternative to YubiKey by fierarul on Thursday December 26, 2019 @04:44PM (#21887066)
I assume your bank has a physical place you can go to in order to get another token and you have a proper business relationship with them and somebody will ID you.

But many other sites have no other alternatives to recover so the recovery codes are a nice solution.

Note that I dislike that my bank gives me their specific hardware token. I am not sure why I couldn't use a 'standard' Yubikey instead.