I’ve been thinking about getting a couple of Yubikeys for a partner and myself, but we share certain accounts. While I would love to have the Yubikey 5 that can store TOTP, that seems like it could be problematic for shared accounts.
Would using the cheaper Yubico Security Keys to unlock Bitwarden Premium vaults, that use a Shared Organization, be a better/more sane option than trying to sync up TOTP secrets every time a new shared account gets added? Any other critiques or suggestions?
You must log in or # to comment.
You may already be aware, but a vulnerability has been recently documented on those.
I’m aware. It doesn’t affect Yubikeys with firmware v5.7 and above, which should be any keys bought in May onward (June to be safe).
I don’t have one yet, so when I buy a key, it should be safe from that particular attack; I’ll RMA it if it’s the unpatched firmware version.
The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM, knowledge of the accounts they want to target and specialized equipment to perform the necessary attack. Depending on the use case, the attacker may also require additional knowledge including username, PIN, account password, or authentication key.
Yeah that’s not a dealbreaker IMO
Can you use passkeys/webauthn/fido2/whatever instead of password+totp for the sites in question?
If so, like, do that: your yubikey supports that shit natively and will completely eliminate your migranes, other than having to make sure the passkey is on each device (which, honestly, is not that complicated.)
Some do have that option. Some do not. I plan to use the passkey option wherever possible, but even in 2024 going on 2025, there’s still far too many websites and services that don’t have passkey options.
The problem is that I need my partner to be able to access certain accounts in the event I’m unavailable, and those accounts don’t always have the ability to register passkeys.
All it takes to sync TOTP is to manually set up the secrets on all keys.
Keeping a second factor in a password manager makes it a single factor, doesn’t it?
It depends. Do you need MFA to access the password manager?
If not, then yes it reduces the effectiveness of having MFA on your accounts but they are still more secure than not having MFA at all.
The password vaults do have MFA already. So they’d still need a password and the upgraded hardware key to get into the vaults.
So let’s say I’m at work, I set up
NewAccountto useYubikey A. Partner hasYubikey Band isn’t nearby. How would I share or retrieve that secret key later? My understanding is that’s not possible if it’s stored on the key, but maybe I’m wrong.I’m not evaluating whether or not you should do that, but, assuming you trust your partner and their op sec, you could send them the secret via a disappearing message on Signal or some other E2E encrypted communication method.
You set it up on your key, they add it to theirs later, the secret disappears into the ether.
Something to consider, certainly. Might be more complexity than my partner is willing to handle, but I’ll have to have that conversation with them.
If you’re just storing the password on the key then, no you can’t get it unless you have the key. The main usage (arguably) for a yubikey is the FIDO2 auth method where you add those keys as MFA methods. That would allow access using either key.
Thanks, that’s kind of what I was thinking.
Sounds like a YK5 might still be a viable use case, but I’d have to do a deeper analysis of what account 2FA secrets would need to be shared versus which can be relegated onto individual keys and safely lose that “always accessible anywhere” trait.
I think of that like putting multiple things in the same basket, but putting two locks on that basket.
From my experience most sites that support YubiKey support multiple YubiKeys already
