Re:That's not how 2FA works
by hehehaha on Sunday January 17, 2021 @10:11AM
(#25811259)
Yes. You must have at least two keys registered. However itβs worth noting that most services do not offer priority. Meaning you can use either one. I think it makes sense to designate back up keys and only to be used when user reports lost/stolen primary key.
[ Parent
| on HN ]
Re:That's not how 2FA works
by thatnerdyguy on Sunday January 17, 2021 @11:15AM
(#25811900)
But what is the story there? You have a backup key, hopefully stored "off site", now you want to enroll in another website. You have to get that backup key before you do that? Or bookkeep which sites you have on the backup key and which you don't?
Actually, this is one area where pgp's use in pass works really well. You use your public key to encrypt passwords. So, adding a new one doesn't need the physical key.
This is a very good point and perhaps something Yubikey and similar services should consider: paired keys. Once paired the backup can always replace original if user reports it missing or lost regardless of when they were paired.