Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

8
  • your second question was off-topic for this site Commented Jul 27, 2018 at 16:50
  • Schroeder is right, the question of yubikeys not being programmable is off-topic, but if I had to speculate, it would be A) to prevent users from locking themselves out by overwriting their secret key and B) to prevent attackers from overwriting the original secret key with a known value before you receive it. Commented Jul 27, 2018 at 17:21
  • @Mr.Llama Actually that's the part that's on-topic :P The off-topic part was a product recommendation request. Commented Jul 27, 2018 at 20:01
  • I am wondering why so many people want to have a clone of their security device. Having a clone does neither increase security nor usability. I recently LOST my yubikey! If I had a clone, there would be no use in having a clone. The yubikey I LOST is COMPROMIZED, so I have to revoke or delete this device from the backend systems or services. At the same moment the clone would be compromized. And if I revoke the original key, the clone would be revoked, too and rendered useless. Commented Jul 28, 2018 at 9:07
  • @cornelinux It's all about tradeoffs. In theory, yes, the lost yubikey could be taken advantage of by someone. But, considering that, I still believe that at least personally for me, it's negligeably unlikely that anyone on earth would actually be able to make use of it (in a short period of time they have until I get a new token, login to my accounts using the backup, add a new one and revoke the old one). An U2F token is just one factor; I use keepassx to keep my passwords very strong, so they would also have to get access to that. Not saying it's impossible, but, again, negligeably unlikely Commented Jul 28, 2018 at 9:19