6 ms·

What have people been using for Yubikeys as an alternative? Installing safes onsite and self monitoring?

viraptor 7y ago
Why would you want to store yubikeys securely, as opposed to recovery codes which you can print out in multiple copies? Store it in multiple semi-secure places. Unless you're running infra for an international corp, government, bank, or are likely to be physically targeted for some reason, you can likely store it in a folder on a shelf. (And if you actually need to worry about things like that, then you've got (or should have) people who think of things like that for you)
- jdnenej 7y ago
  You can check to see the key is still there but you can't check to see if anyone has copied the codes. The key is meant to be not possible to duplicate.
  - viraptor 7y ago
    There are many ways to make it easy to see things have been tampered with.
    - ojilles 7y ago
      ...but not that many that guarantee/clarify if something was read/duplicated. That’s what a safe would buy you.
      - ghaff 7y ago
        Lots of ways to set markers against all but seriously professional adversaries. I’d personally worry more about losing access to your key/combination. Frankly your main threat is probably a fire or flood. Not a Russian agent breaking into your house.
      - viraptor 7y ago
        No, I really mean "many ways". Just search for tamper evident products. There's a huge number of ways you can get that guarantee. For example this: https://harcor.com.au/products/security-seals/tamper-evident-bags/a4-document-bag-411 https://harcor.com.au/products/security-seals/tamper-evident...
    - rocqua 7y ago
      Greatest trick i heard is a simple paper seal, sprinkled with glitter, and then varnished with nail polish. Take pictures of the seal, and compare the seal against the picture.
Thorrez 7y ago
It depends on your threat model. If you're worried about sophisticated attackers physically breaking in to your place to steal a Yubikey to steal your accounts, you should also worry about them physically tampering with your computer to install malware, and thus need monitoring for that as well. If you can't do the monitoring, and you face very advanced attackers like this, it's probably best to only use a laptop that you physically keep with you at all times, and then you can keep your Yubikey with you at all times too. If you just want to protect against an attacker sophisticated enough to steal a Yubikey but not enough to install malware, then maybe instead of a second Yubikey in the safe deposit box, you could have an encrypted recovery code in the safe deposit box, and either memorize the password, or store the password on your computer. I've never heard of attackers stealing a Yubikey though. More likely is the attacker will social engineer the website's support into giving over your account.
- michaelt 7y ago
  I’ve heard safe deposit boxes as an answer to the question “what if my house burns down with my yubikey/recovery code sheet in it, and none of my friends or family are as security-conscious as me so I can’t leave the spare with them”
  - Thorrez 7y ago
    Yes, fires are one of the main problems that a safe deposit box protects against. But Bucephalus355 seemed to be ignoring them already by considering just having a safe onsite.
TomK32 7y ago
From the article is sounds like most of those cases are banks drilling open the boxes and putting the contents into storage. A better and stricter inventory system with strict and punitive regulation is what is needed, not some technical gadget.
- ghaff 7y ago
  Furthermore, electronics fail. If there’s some records including 2FA codes that you want to store in a safety deposit box, fire box, etc. I absolutely want at least paper backups whether or not I also have a Yubikey, SD card, etc. eg if I have a home inventory I absolutely want prints even if it’s also in the cloud someplace.
  - scruple 7y ago
    I went through this recently. It's such a PITA. I ended up with physical copies in 3 different places because all of a sudden redundancy is a reality.
    - ghaff 7y ago
      You think you’re reasonably well backed up until the sh*t hits the fan and you realize everything is hanging by a much thinner thread than you thought. Recent events I experienced have added really working through record backups to my todo list.
      - jdeibele 7y ago
        I keep paper copies of the backup 2FA codes for Google and LastPass in my wallet and have been pretty happy with that strategy. A couple of years ago, I had my wallet fall out of my pocket while I was on a boat. My phone was back at the dock safe and dry so I had my primary authenticator. And I probably had printed copies somewhere at home. I've been much more diligent since then about making sure there are copies and that they're accessible.
- Latty 7y ago
Spooky23 7y ago
Yes. Paper is best though. It is also sometimes in your interest to get things in the custody of an individual, ideally your attorney. If the owner of a deposit box becomes aware of your death, they will seal it until a court order is obtained.
- jdeibele 7y ago
  At least in California, the bank opened it for me (as personal representative) so that a bank employee and I could inventory the contents. My aunt was a hoarder. At that point, I was actually relieved that the box was empty and I wouldn't have to go through the process of claiming the contents. My aunt was also somebody who bought gold and silver, something that was promoted heavily to people in conservative Orange County California when Obama became president and end times were near. Chase made it very clear that I was basically storing things at my own risk. I could deposit US coins from the 1880s at face value of $20 and get FDIC insurance. Instead, since they were about $1200 each at the time, I put them in the safe deposit box. Before that, in Oregon, my dad died but I was on the list of people allowed to use the box so I had access. That might be an option if there's somebody you really trust. The banks do charge about $100 to drill the lock if you lose the keys. It's possible that you could have somebody authorized to use the box but not give them a key.
  - Spooky23 7y ago
    In New York, the box is sealed once the death is known to the bank, and cannot be opened without the probate court’s permission. It creates problems when folks store their wills in the box!

Why would you want to store yubikeys securely, as opposed to recovery codes which you can print out in multiple copies? Store it in multiple semi-secure places. Unless you're running infra for an international corp, government, bank, or are likely to be physically targeted for some reason, you can likely store it in a folder on a shelf. (And if you actually need to worry about things like that, then you've got (or should have) people who think of things like that for you)

jdnenej 7y ago
You can check to see the key is still there but you can't check to see if anyone has copied the codes. The key is meant to be not possible to duplicate.
- viraptor 7y ago
  There are many ways to make it easy to see things have been tampered with.
  - ojilles 7y ago
    ...but not that many that guarantee/clarify if something was read/duplicated. That’s what a safe would buy you.
    - ghaff 7y ago
      Lots of ways to set markers against all but seriously professional adversaries. I’d personally worry more about losing access to your key/combination. Frankly your main threat is probably a fire or flood. Not a Russian agent breaking into your house.
    - viraptor 7y ago
      No, I really mean "many ways". Just search for tamper evident products. There's a huge number of ways you can get that guarantee. For example this: https://harcor.com.au/products/security-seals/tamper-evident-bags/a4-document-bag-411 https://harcor.com.au/products/security-seals/tamper-evident...
  - rocqua 7y ago
    Greatest trick i heard is a simple paper seal, sprinkled with glitter, and then varnished with nail polish. Take pictures of the seal, and compare the seal against the picture.

Thorrez 7y ago

It depends on your threat model. If you're worried about sophisticated attackers physically breaking in to your place to steal a Yubikey to steal your accounts, you should also worry about them physically tampering with your computer to install malware, and thus need monitoring for that as well. If you can't do the monitoring, and you face very advanced attackers like this, it's probably best to only use a laptop that you physically keep with you at all times, and then you can keep your Yubikey with you at all times too. If you just want to protect against an attacker sophisticated enough to steal a Yubikey but not enough to install malware, then maybe instead of a second Yubikey in the safe deposit box, you could have an encrypted recovery code in the safe deposit box, and either memorize the password, or store the password on your computer. I've never heard of attackers stealing a Yubikey though. More likely is the attacker will social engineer the website's support into giving over your account.

michaelt 7y ago
I’ve heard safe deposit boxes as an answer to the question “what if my house burns down with my yubikey/recovery code sheet in it, and none of my friends or family are as security-conscious as me so I can’t leave the spare with them”
- Thorrez 7y ago
  Yes, fires are one of the main problems that a safe deposit box protects against. But Bucephalus355 seemed to be ignoring them already by considering just having a safe onsite.

TomK32 7y ago

From the article is sounds like most of those cases are banks drilling open the boxes and putting the contents into storage. A better and stricter inventory system with strict and punitive regulation is what is needed, not some technical gadget.

ghaff 7y ago
Furthermore, electronics fail. If there’s some records including 2FA codes that you want to store in a safety deposit box, fire box, etc. I absolutely want at least paper backups whether or not I also have a Yubikey, SD card, etc. eg if I have a home inventory I absolutely want prints even if it’s also in the cloud someplace.
- scruple 7y ago
  I went through this recently. It's such a PITA. I ended up with physical copies in 3 different places because all of a sudden redundancy is a reality.
  - ghaff 7y ago
    You think you’re reasonably well backed up until the sh*t hits the fan and you realize everything is hanging by a much thinner thread than you thought. Recent events I experienced have added really working through record backups to my todo list.
    - jdeibele 7y ago
      I keep paper copies of the backup 2FA codes for Google and LastPass in my wallet and have been pretty happy with that strategy. A couple of years ago, I had my wallet fall out of my pocket while I was on a boat. My phone was back at the dock safe and dry so I had my primary authenticator. And I probably had printed copies somewhere at home. I've been much more diligent since then about making sure there are copies and that they're accessible.
Latty 7y ago

Spooky23 7y ago

Yes. Paper is best though. It is also sometimes in your interest to get things in the custody of an individual, ideally your attorney. If the owner of a deposit box becomes aware of your death, they will seal it until a court order is obtained.

jdeibele 7y ago
At least in California, the bank opened it for me (as personal representative) so that a bank employee and I could inventory the contents. My aunt was a hoarder. At that point, I was actually relieved that the box was empty and I wouldn't have to go through the process of claiming the contents. My aunt was also somebody who bought gold and silver, something that was promoted heavily to people in conservative Orange County California when Obama became president and end times were near. Chase made it very clear that I was basically storing things at my own risk. I could deposit US coins from the 1880s at face value of $20 and get FDIC insurance. Instead, since they were about $1200 each at the time, I put them in the safe deposit box. Before that, in Oregon, my dad died but I was on the list of people allowed to use the box so I had access. That might be an option if there's somebody you really trust. The banks do charge about $100 to drill the lock if you lose the keys. It's possible that you could have somebody authorized to use the box but not give them a key.
- Spooky23 7y ago
  In New York, the box is sealed once the death is known to the bank, and cannot be opened without the probate court’s permission. It creates problems when folks store their wills in the box!