How do I revoke a FIDO / WebAuthN token from every service?
fido security WebAuthn yubikey · 11 comments · 400 words · Viewed ~484 times.
After my blog post about recovering my accounts after a disaster, I followed the most repeated advice:
- Get two YubiKeys
- Associate them both with your accounts
- Keep one off-site in a safe location
OK, done! My wife and I spend a very boring evening going through every single account we have which supports FIDO tokens with WebAuthN - about a dozen in total. We manually paired two keys each. We put our main key on our keyrings, then drove out to the woods and buried our spares in a a waterproof box in a top secret location0.
But what if I lost my keys?
Perhaps I could have been pickpocketed or just been careless and dropped them when getting my wallet out. Either way, I can buy new eurocylinders for my home's doors, replace the padlock on my shed, and grovel to work for a new locker key.
And then, of course, I would have to dig up my backup key and start the painful process of revoking the old one. But here's the snag...
I have no idea which services I've associated my WebAuthN token with!
Firstly, there is staggeringly little chance that the person who found / took my keys would also know my username and password for various services. But we use MFA because we're paranoid, right? So it makes sense to invalidate the lost token to prevent even the slimmest chance of it being used against me.
Secondly, obviously I know some of the major services that I associated the token with - Facebook, Google, and the Russian crypto exchange where I keep all my money1. But what about the rest? Should I have made a list of each service I used? Should I have recorded it in my password manager?
Apparently a YubiKey can only hold 25 FIDO2 tokens, but unlimited FIDO U2F tokens. I'll be honest, I've no idea how many I have. And I don't think there's any way to query my key to see which services it was registered to.
It is probably a good thing that there's no big button which would universally revoke a key. That would be an extremely tempting target for abuse.
But I wish there were an easy way for a user to see where they had used their token. As it stands today, that's impossible.
Some thoughts on the YubiKey EUCLEAK Vulnerability
Šime Vidas says:
You can't, but I don't think it's a big deal: sites that let you use your security key without it having a PIN almost always ask you for a password too (the key is there only as a second factor)
So an attacker would need both your key and password. For most people this is outside the threat model.
More comments on Mastodon.