Author: Stefan Lechner

Yubikey (or other FIDO2 token) vs. Google Authenticator (or other TOTP app)

Phishing protection:
win for the TOKEN
WebAuthN uses a handshake where the site (reported by the browser) is one of the inputs. That said it simply won’t work for a phishing site.
An entered TOTP code, will provide the dark side, as long as they can keep the session alive, a ton of opportunities to do something like disable 2FA and/or roll out a new device with just username and password.

Long-term security / key exposure:
win for the TOKEN
You can’t get a key out of a YubiKey, but there are plenty ways to export / backup data of your APP

Ability to connect it to the user:
win for the TOKEN, no chance if you find a TOKEN on the street and ther is nothing on like an email phone number handler whatever to connect it to the user who lost it. Same situation an a phone most likely to be a whole different ball game, speaking of imformation provided to the finder.

Ability to authenticate the user:
win for the APP, your phone the home of the APP is locked, yor TOKEN usually not

Revocability:
a very very small win for the TOKEN
some sites and services, not all, will allow you to revoke a single hardware TOKEN, without revoking others (eg the BACKUP TOKEN)
Try this with your APP (we are not talkin about revoke a single account within the app)

If you are using your YubiKey with a service or application, the policy for lost or stolen YubiKeys depends on how that service or application deals with the situation

Make sure to remove your lost YubiKey as a 2FA method after you regain access to your account.

Question: How do I perform a LogIn if I don’t have my Yubikey
Answer: Use your Backup Code, that you generated when you added your YubiKey for that account. Or use your Backup YubiKey.

If you have already lost your YubiKey, do not panic. Many services have a verification process to allow you to verify your identity to regain access. Note this is not a walk in the park, depending on the service you used.

To be clear:

Your Yubikey doesn’t store identifiable usernames and does not store any of your passwords. Anyone who finds your YubiKey would have absolutely no way of knowing which accounts it can log in to.

This changes a little if the person who **finds** it knows the owner, everybody else who finds a YubiKey on the street, train, cafe, airport and on and on won’t be able to figure out whose key it is.

So don’t write your name our your handle on it.