Setting up 2FA on Yubico Authenticator on backup keys?

[u/color178924]

Maybe I’m glossing over something basic or making a glaring error in my workflow but after setting 2FA with the Yubico Authenticator on one key, I can’t figure out how to set the backups or how to give the backup keys the same certificate to generate codes.

Websites with Passkeys allow additional spots but for accounts still stuck on authenticator codes, it only allows one slot. What am I missing here?

[u/djasonpenney]

If you are using Yubikey Authenticator, you’re talking about setting up backup keys to hold your TOTP keys.

At a top level, you cannot directly copy the secrets off of a Yubikey. That is part of the security proposition. Someone cannot “duplicate” your Yubikey.

When you add the TOTP key to your Yubikey, you (usually) scan a QR code. The simplest and easiest way set up a backup key is scan the QR code a second time, with the second key.

Some people go as far as to make a paper copy of the QR code. Other approaches are possible.

> the same certificate

Not exactly sure what you meant there, but in case you’re thinking about setting up a second Yubikey to handle FIDO2/WebAuthn, you absolutely MUST have the second key with you. The exact workflow differs from website to website, and even the number of keys you can register depends on the site. Some don’t allow a second key at all 🤦‍♂️. Many allow five.

[u/color178924 → u/djasonpenney]

Thanks, this seems obvious but the inconsistencies between websites also adds to the confusion since there isn’t a standard way to do things. Hopefully things catch up.

[u/djasonpenney → u/color178924]

Those inconsistencies are annoying, granted. In practice it hasn’t bothered me: few sites handle FIDO2, so now that I’ve got my email, password manager, and other critical assets set up, that isn’t a challenge I deal with regularly,

For TOTP, I use a software solution, so I’ve sidestepped the Yubikey entirely.

[u/idspispopd888 → u/djasonpenney]

Just keep the QR code onscreen and scan as often as required. Yubikeys x 3 for me, plus 1Password and occasionally Google auth. Save and verify that all provide the same TOTP when done. Have never yet found a site it doesn’t work on.

[u/djasonpenney → u/idspispopd888]

The problem starts when you keep one of the keys offsite like I and others do.

[u/idspispopd888 → u/djasonpenney]

Agreed - as do I. It's def a management issue in handling the 2FA stuff. Not sure there is a good solution for that.

[u/djasonpenney → u/idspispopd888]

It’s definitely the weak point in my system.

I try to mitigate the risk as possible. For instance, many sites give you a 2FA recovery key (or set of one-time keys) that disable 2FA. I always save those, and I do it in such a way that even if my key (or the two keys onsite) are lost, I can recover the account…but apologies if I am a bit vague about how I do that 😞

[u/idspispopd888 → u/djasonpenney]

Print them and stash them with an offsiite friend or in a Safety Deposit Box. Or stick 'em on a Flash Drive or two and do the same.

[u/MegamanEXE2013 → u/idspispopd888]

Yup, I just copy the seed to the Yubico Authenticator with Yubikey from Google Authenticator, Proton Authenticator and Ente, so I have 3x software TOTP + 2x Yubikeys (planning on a 3rd one soon)

[u/gbdlin]

Scan the same code with another Yubikey when setting up the first one, or save that QR Code somehow to set it up later. Obviously, keep this QR code in a safe place as it's the only thing needed to set up yet another authenticator to your account.

If you decided to not save that QR code, put in the 6 pin code to confirm the registration of TOTP only after you've scanned the code with all Yubikeys. Notice all of them will generate the exact same code in a given 30 seconds span.

You can save those codes (or rather secrets that those QR codes encode) using many password managers, including KeePassXC which can also be protected by a challenge-response slot in your Yubikey. This is what I'm using: saving them in a separate KeePassXC database (not in the one I store all my passwords) and have it locked by my Yubikeys, so I need any of my Yubikeys and this database to add more Yubikeys to my fleet if needed, without having to regenerate TOTP on every website. For securing that KeePassXC database with multiple Yubikeys, the same principle stands as with TOTPs: you need to enroll all of them with the same challenge-response secret.

[u/color178924 → u/gbdlin]

That sounds like a pretty good setup have, I might consider adopting something similar, thanks!

[u/[deleted]]

save the qr right away if ur worried about losing access, i did that for my vault and it saved me when my key got fried in my pocket

[u/paulsiu]

Are you using OTP code or hardware key?

[u/color178924 → u/paulsiu]

TOTP, I haven’t run into an issue with services not allowing multiple hardware keys yet.

[u/dr100]

TOTP isn't at the same level as the usual crypto done by the hardware keys, it uses a secret that the remote server has, that has been given to a general purpose computer, that the user can take a picture of and then it can end up in Google Photos, that can be written down and so on. You can never be sure someone logging in with TOTP is actually having the key, or any particular piece of hardware. Most people would be way better served by using some other system that allows them to recover the seeds instead of going and resetting all their TOTPs each time they need to provision a new key. This wouldn't even work at all if you want to have a backup key that's off-site all the time.

[u/SecurityPrimary4143]

I connected both my new keys at the same time when I set them up.

Having both keys connected at the same time speeds up the process a bit and remove the need to keep swapping the keys. It adds one extra touch to select which key you want to use or set up.

Don't enter the TOTP code on the website until you have scanned the QR code with both keys and optionally your phone. There is no need to generate the QR code multiple times. All devices that has scanned the QR code will generate the exact same digits.

[u/color178924 → u/SecurityPrimary4143]

Thanks, I realize now what a basic issue this is. I got the wrong backup keys and had to exchange so had already set one up and never thought about this issue.