Comment by palata
7 days ago
I am not sure I completely understand.
> so a Yubikey passkey is very quickly a single-point-of-failure
It is a single point of failure when there is one. As soon as you use two, then it's not a single point a failure anymore, is it?
The counter argument I usually read is: "Yeah but it is not practical, because you need 3 yubikeys: the first 2 with you, that you enroll everywhere, and one in a safe. And every time you add a new passkey, you need to go get the one in the safe, replace it by another one, and enroll the one of the safe. You can't spend your life driving between your desk and your safe".
But I have been using multiple Yubikeys for... 8 years now I think? I don't remember the last time I enrolled and important key. Sure, once in a while I add a website, and it is a bit annoying to have to enroll the other Yubikeys at a different time. But it really doesn't happen that often, and anyway most of those websites allow me to recover my account with my email. So it is actually practical to have a "convenience yubikey" for websites that don't matter so much, and in case this Yubikey dies... well those websites were not so important, and anyway I can recover from my email.
The difference for the important websites (and really, I don't think I have really important websites in my life that don't allow me to recover by going in person with my ID, but for the sake of the argument) is that I actually do have multiple Yubikeys, one of which is stored away.
Whereas the master password of my Bitwarden account is a single point of failure, and the security of my online Bitwarden account is as well.
That's a clever setup that I hadn't seen before. Some extra downsides:
- Relying on emails for account recovery prevents creation of anonymous accounts.
- Have you ever lost your "convenience yubikey"? People underestimate how painful mass account recovery can be.
- The cost of 3 yubikeys can be substantial for some demographics.
- Important accounts are not properly backed up until you drive to your safe. That can be many days for a bank deposit box, or even longer if you're traveling.
Overall that's a lot of compromises for what should have been just "put this recovery key/password in a safe and forget about it until needed", if the protocol was better. And definitely not something that can be widely recommended.
> ... just "put this recovery key/password in a safe and forget about it until needed"...
Surely that is also impacted by:
> Important accounts are not properly backed up until you drive to your safe. That can be many days for a bank deposit box, or even longer if you're traveling.
Nope! You could have one "master recovery key", the public part loaded on your device (to be registered during account creation) and the private part sitting in your safe. Or even a number of pre-generated recovery keys. You could also give those keys a higher "priority", since they're offline, so that they can revoke lesser keys in case of account compromise.
I proposed a protocol with this feature almost a decade ago: https://www.researchgate.net/publication/343318317_Privacy-a...
The problem is that the passkey protocol prevents you from adding a (additional) key you don't currently control. This is what crote was referencing here:
> Passkeys have to be online to enroll additional keys, so any kind of software or smartphone solution is going to depend completely on cloud sync.
5 replies →
> I have been using multiple Yubikeys for... 8 years now I think? I don't remember the last time I enrolled and important key.
This probably makes your use case somewhat unusual...
> I actually do have multiple Yubikeys, one of which is stored away.
...and this probably puts you in the 0.0001th or so percentile of users. It's really a great security strategy if you can pull it off, but practically almost nobody can.
Not sure what you mean. "Normal people" have to enroll important keys much more often, and cannot use multiple Yubikeys?
My feeling would be that "normal people" can always recover their accounts from their main email, which makes the main email the only "important" account. So having a Yubikey always plugged in is a "nice convenience".
Now to be honest, I would expect that "normal people" are absolutely fine with passkeys on their smartphone, and don't consider it a "trap".
I would just expect that people who consider it a trap are able to use a Yubikey the way I do.
> I would just expect that people who consider it a trap are able to use a Yubikey the way I do.
I think the people most likely to be hurt by it being a trap are unfortunately those least likely to be able to juggle multiple Yubikeys.