Brother, quick tips: #1 - If you screenshot the QR code and save it on the same secure place as the back-up codes, you can always re-scan it when new hardware is purchased. #2 - Put a pin/password to access those TOTPs just in case you lose the Yubikey.
For durability of Yubikeys: Many seasons ago, my metal keyring broke and my years-old Yubikey was released to the wild while I was running. 4 months later as the snow melted, I spotted it on the path frozen into a muddy puddle. Still worked fine. GPG key and all. (Yes, yes, I'd already moved to a replacement HOTP + GPG set on a new Yubikey in the intervening months ;-) )
I never really thought that if you lost your yubikey that someone would might be able to change your password and use your OTP to gain access to the account if your have previously been pwnd as they can see which email address you log in with due to it being stored on the yubikey for some accounts.
A couple of side-notes: 1) Up to a maximum of 32 TOTP codes can be saved per Yubikey. This can be a severe limitation for some people. 2) One can password protect the Yubikey in the event of loss or theft.
You can also transfer the google authenticator to your new phone through the built-in export feature. This will maintain your TOTP Keys. You will need to verify some or most, but its better than starting over.
I was gonna say that not blindly enabling a new device with all your 2FA data was a feature not a bug. Good to know they have an export feature, though.
Used to be a diehard user of Google authenticator. Switched to Authy and it's so much better, all data securely backed up with zero knowledge based encryption to the cloud, PIN / biometric protection for the app, instant update of codes across multiple devices, super secure after turning off multiple devices option so only existing devices can allow TOTP codes. Authy is everything an authenticator app should be.
Great video. I spent hours looking around RU-vid for this information and you laid it out properly. You probably saved me hours of downtime having been able to set up my backup key.
I would not add 4 different backups like e.g. software ones since each additional backup creates an additional vulnerability in terms of hacks (software) or stealing/loosing (hardware) . I would recommend one hardware key for daily usage, one hardware key stored in a safe and handwritten recovery codes for each account at another safe place. I think 1 HW-key + 2 backups are more than enough and everything beyond this creates more risk! My humble 2 cents ;-)
Agreed. I keep my google auth codes on an back up security iPhone I keep offline. I don’t agree with the 1 time passwords to print either. to easy for hackers to get.
Google authenticator is allowing to move to different phone and all related account are moved to new device in 1 go. At least I did so earlier this year
@@futurecactus No, BW saves a URI which includes the code you need to add an account to your 2FA app. And even better BW preps the TOTP in your clipboard so you can paste it when prompted for it. No need to use another app.
Doesn't this start to tarnish, maybe not defeat, the purpose though? I struggle with that and backup codes... Where to store them. In Bitwarden? But I need my Yubikey to get into Bitwarden in the first place. And then if my Bitwarden is compromised, is my 2FA then compromised too?
@@fonte935 All valid points. Some would describe this as putting too many eggs in one basket. But like you said, a Yubikey and a good master password will protect your BW vault. I am comfortable with this level of security, but to each their own.
You don't have to do them at the same time. Just write down the numbers. Displayed when you pick can't use qrcode. Then can be entered manually on the other keys.
It is possible to add a Ubiquiti key later on. However, you will need to take a screenshot of the QR code and save it to an SD-card, USB-stick and safely store it outside your computer. When you want to add it to a different key, just insert the storage device into your computer, fire up the authenticator and let it find the QR code on your screen. It works fine 😊
in fact, not only can you move google authenticator tokens over to another phone through its built in export feature but there is also a python script that can decode the 2 codes for transfering the keys so you can then insert them onto a yubikey thats on the one hand a nice feature, but for some cases you want only one copy, thats when the yubikey is needed ;D
Yubikey rocks....the only thing that sucks is many entities STILL only allow for just SMS text 2 factor (total crap as we all know) or at the very best an authenticator app. Hopefully this will change by year 2024 or so.
A couple of questions, 1. isn't it possible for a RAT malware to notice when the QR code pops up and take a screenshot without you knowing and then pass that SS onto it's control server, therefore compromising your security? 2. Same question for the backup codes which you generated, also, you said "store these codes somewhere safe" well, how can you? If they are on your computer or you copied them to the clipboard, then why can't a RAT see them or look for them anywhere you store them on your HD? 3. By backing up further with Google auth, you've just made that the weakest link in your "2FA security chain", which means there was no point to use a hardware key. If an attacker can steal the QR code your end, or the same token generated on hack the company server and find the QR code, you can be hacked using that. Therefore the Ubikey is redundant. The whole point of using a Ubikey is to not then use things like Google auth because the Ubikey keeps everything on the key and nothing goes to the website. So even if the website is hacked, no one can get into your accounts. Please let me know where I'm going wrong if you think that I am and please tell us if a RAT can just screenshot the QR or the codes and make copies of the token. Thanks.
That was a very clear explanation. For some reason, I was having issues with scanning the QR. I did not want to use my camera as it will store that photo shot on google photos and it literally can be hacked. I have a few questions that i really need some answer and would appreciate it very much if you can help. the first concerns backing up my iphone. I currently am using an iPhone SE 2nd ed. I thought, what if i lost this thing or it broke?? This would be devastating to me. So my question is this, Do you know if it is possible to back up an exact image of my iphone to another iphone that i have if I were to take out the SIM card and put it in this backup iphone? I am guessing it would have to have the same number as my current iphone as that is how all these algorithms are configured for TOTP using Yubico Authenticator? I want to back it up exactly like the old iphone then pull out the SIM card and put back in my current iphone. If it breaks or I lose it, I can get another SIM card from my provider and it will still have the same number. Is there any easier way to back this up with all these codes on it? Or not? I will send PM for the second question but it would be nice to do a video on it as no one has ever even discussed how this can be done, and it can. Edit to say i can't submit. Just beware that Google Authenticator can be hacked from your iphone or desktop. I don't know which one, but it happened to me and it was used to steal crypto accounts and they were able to produce correct 6 digit numbers even though my iphone was never out of my possession. This is why Yubikey is an absolute neccessity.
I think Google Auth will allow you to backup TOTP to the cloud now and restore to new phones. I was able to do that with Lastpass and Google Auth when I got my Pixel 6
Love your videos Sir, thank you! May I ask about the rotary telephone in the background? Does that offer a form of security from alternate forms of phones? I've actually pondered the use of a rotary phone and wondered if it's disconnected nature could be of benefit, and here you have one at your desk! Could you please elaborate? Thanks!
Google Authenticator has a Export function that generates a high density QR style code with all the codes embedded in it, you scan what with your new phone's Google Authenticator. Transfer done. Easy as pie. Been there for years (video is a year plus old at this point). Now, I doubt anything but GA can understand the format of that QR code, you also can't screenshot it, GA Export disable screenshot while its on screen.
Good video! I've some basic question: I'm using Yubico authenticator which opens when attaching my primary Yubikey to the smartphone. How do I add a backup Yubikey to the authenticator for the case the first key get lost?
Hey, just a note why it's actually good not to be able to "copy" your second factor like that (and why usually software solutions do not offer an easy transfer of your tokens): security. If you can copy it, everyone else can too. Even worse when you do it via a cloud service like Google. The idea behind that second factor is to use something that's in your possession. Also a reason why a software on the same device (not talking about the yubikey solution, that requires a hardware device) doesn't make a lot of sense. Services should offer support for more than one device if you want to do it right, or, even better, use the security codes as is. If you lost one of your keys, do you know exactly what copies it holds? You would need to cycle all accounts on it again to ensure there is not a device out there that holds your tokens. So instead of creating copies, which is against the idea of having a second factor only once, maybe store the Backup Codes in a (digital) safe you could protect with another Yubikey. And yes, not as convenient as having a copy on multiple devices, but this should be about security.
Hi, a couple of questions for you, 1. Isn't it possible for a RAT malware to notice when the QR code pops up and take a screenshot without you knowing and then pass that SS onto it's control server, therefore compromising your security? 2. Same question for the backup codes which you generated, also, the guy said "store these codes somewhere safe" well, how can you? If they are on your computer or you copied them to the clipboard, then why can't a RAT see them or look for them anywhere you store them on your HD? I know you said something about a "digital safe" but how cna that prevent the RAT from taking the code if it appears on the sceen even for one moment? 3. By backing up further with Google auth, he's just made that the weakest link in your "2FA security chain", which means there was no point using a hardware key right? If an attacker can steal the QR code your end, or your token by hacking the company server, which must store a copy, maybe even in plain text, you can be hacked using that. Therefore the Ubikey is redundant. The whole point of using a Ubikey is to not then use things like Google auth because the Ubikey keeps everything on the key and nothing goes to the website. So even if the website is hacked, no one can get into your accounts. Please let me know where I'm going wrong if you think that I am and please tell us if a RAT can just screenshot the QR or the codes and make copies of the token. Thanks.
1. There is always a risk when doing things online. What’s important is we acknowledge the risk and find ways to reduce or mitigate it. I use my rapsberry for that. Its connection is behind a checkpoint router hardened to allow specific ports. Connection to the internet is very limited.Its offline and in a location (point 2) unless I have to enroll additional accounts to yubikey. 2. Back up codes, qr codes ,private keys can be stored on a safe location. “Safe” is based on your risk tolerance. It could under a kitchen sink or in a safety deposit box inside a bank.
hi, i used to use sms as 2FA, and then i added a yubico 5 as another 2FA. but i only have 1 key and i didn't remove the sms from the 2FA. so i am now as weak as on SMS, is it? thanks
I once lost my YubiKey at one of the airport exit lanes where I used to work. When I found it the following day, I could tell by the many dents that it had been run over several times. Still works.
The yubico authenticator app does not store anything. The keys themselves store the TOTP details, so all that you need is to install the app on a new machine and plug in your existing key(s)
You can export all codes from google authenticator very easily as long as you have both devices just by clicking the 3 dots on the top right. You then scan a QR code on the new phone, then you get back all codes that easy.
@@abcuughklkj I personally have google authenticator as a backup and in the past I lost my phone. However I exported on my ipad and if you have an old iphone you can give it extra life.
@@abcuughklkj that's why Apple for example forces you to make 2 and that is why I have 3. I hope passkeys takes off we can so we won't need a bunch of passwords
First I will recommend you Bitwarden. Second, once you have the codes INTO yubikey authenticator... how do you use them? You didn't mention that... Do I need only the key or I must copy the code from the program?
Nice video overview. Unfortunately, it's difficult to use the Yubico Authenticator app if you primarily use a Chromebook. The Android app downloaded on Chromebook doesn't seem to function properly and doesn't recognize my YubiKey from the USB port. I wish there was a good solution for Chromebooks. Also, the Authenticator app on my Android phone always gives an error when trying to use NFC. So, I can really only use it by plugging a USB-C key into my phone. This all sounds like a great system in concept, but just not working well for me. Oh well.
You said you have to make these keys all at once, but couldn't you just use the secret code at a later date? I see "add account" under the "scan QR code" option. I use WinAuth to back up the secret code to an encrypted file and then you keep them for a later use. You can even use otpauth format to set up some authenticators to use 8 digit code such as the one used for Battle Net. BTW, when I close my eyes, you kind of sound like John Ritter.
Microsoft Authenticator allows you to backup your TOTP and restore it, I stopped using Google's for this exact reason. I formatted my old phone and soon realized everything was gone on the new phone. Luckily I had all my backup codes, but definitely did not like the experience.
If you use Apple 2FA authentication, your codes come with you. but tbh. Why do you have your 4 backup on google etc.? Is they idea of an YubiKey not to storing your Passwords on servers which are connected with the Internet?
If you scan the QR code with multiple apps, say 2 yubikeys and 1 Microsoft authenticator. When it asks for the code in the next step you can only supply one, so will it work with codes from the other apps?
How do all you Yubikey users integrate them into your life? It seems like people put them on keychains they otherwise carry everyday. I don't have one of those. It needs to be with me all the time but I don't want to have to constantly remember to bring one with me. Does it make sense to stash them all over the place? One in my office, one in my backpack, one in my car? That sees like it would get my 75% of the way but then I've got multiple copies of them which seems like a vulnerability to me.
You’ve got it wrong with google auth. I’ve moved all my 2factors google auth codes many times with the export function. I’ve been harassed by hackers for 5 months now and they still don’t have my google auth codes. Now I just keep them all on a phone I rarely use online with Face ID.
Dude. This video is super confusing. What is Ubiquity. I have yubikey. I've never seen this Ubiquity thing and I've never had to input a passcode after inserting and touching the yubikey. Where does all of this come from?
MS authenticator will BKUP so you can restore on new device and if you were on android so would google Auth I assume. Some people dont like that I know
So do you use that as an excuse to NOT do 2FA then? I sure hope not. "People have died in car crashes even when wearing their seat belt, so why even wear it?" Not a good argument.
@@jameshuegli3534 There were a few unique cases of hacking involving sniffing TOTP from smartphone apps, but it *always* involved some sort of malware like Android trojans. And to get trojan on Android or iOS you need to install some super shady crap from super shady untrusted sources. Basically, it almost always happens via social engineering.