1. Get two YubiKeys
2. Associate them both with your accounts
3. Keep one off-site in a safe location

OK, done! My wife and I spend a very boring evening going through every single account we have which supports FIDO tokens with WebAuthN - about a dozen in total. We manually paired two keys each. We put our main key on our keyrings, then drove out to the woods and buried our spares in a a waterproof box in a top secret location⁰.

But what if I lost my keys?

Perhaps I could have been pickpocketed or just been careless and dropped them when getting my wallet out. Either way, I can buy new eurocylinders for my home's doors, replace the padlock on my shed, and grovel to work for a new locker key.

And then, of course, I would have to dig up my backup key and start the painful process of revoking the old one. But here's the snag...

I have no idea which services I've associated my WebAuthN token with!

Firstly, there is staggeringly little chance that the person who found / took my keys would also know my username and password for various services. But we use MFA because we're paranoid, right? So it makes sense to invalidate the lost token to prevent even the slimmest chance of it being used against me.

Secondly, obviously I know some of the major services that I associated the token with - Facebook, Google, and the Russian crypto exchange where I keep all my money¹. But what about the rest? Should I have made a list of each service I used? Should I have recorded it in my password manager?

Apparently a YubiKey can only hold 25 FIDO2 tokens, but unlimited FIDO U2F tokens. I'll be honest, I've no idea how many I have. And I don't think there's any way to query my key to see which services it was registered to.

It is probably a good thing that there's no big button which would universally revoke a key. That would be an extremely tempting target for abuse.

But I wish there were an easy way for a user to see where they had used their token. As it stands today, that's impossible.

I use a USB thumb-drive sized hardware token and they're nifty - but a little impractical.

Since the great working from home experiment, I don't have my keys on me at all times. This means my Yubico Neo sits on a keychain, in a pocket of a coat which is rarely worn. So every time I need to use U2F to authenticate with a service, I have to trek around the house trying to remember where I last saw my keyring.

Wouldn't it be great if I could wear my Yubikey? Some high-tech jewellery would be fab!

To be clear, this isn't an original idea:

Joanna Rutkowska

@rootkovska

Anyone could recommend a U2F-compatible NFC ring (as in: jewellery)?

(Additional requirements: not bulky, women sizes; silver, not gold pls :)

---

And some people do wear their keys as pendants.

There are also Yubikey earrings:

*:･ﾟ✧ Samantha ✧･ﾟ:*

@samantha_gold

Working late in the labs on these yubikey earrings! eeee! pic.x.com/fdto5ksdwz

---

So why not a ring? A ring doesn't take up much space on the body, they're rarely taken off, and they're socially acceptable jewellery for most people.

A basic NFC ring costs less than two pounds! But it doesn't have the necessary processing power for U2F.

The OMNI ring is £70 and looks like it has the right hardware. But, sadly, they appear to be incompatible with the FIDO specification.

The cheapest FIDO2 U2F NFC key is about £30. So it shouldn't be impossible to put the hardware into a more aesthetically pleasing form factor.

Token were planning to release a WebAuthn ring "soon" - but with no price nor predicted availability. Their social media hasn't been updated in two years. Similarly, Motiv were planing on releasing a WebAuthn ring - but they got bought by a company called Proxy - who have since fallen into a Web3 hole never to be heard of again.

So - this is my version of Cunningham's Law. If I blog saying something doesn't exist - some smartarse will immediately post a link to some Shenzhen store selling them for a quid each!

There are no WebAuthn rings - or other jewellery-like form factors. And that sucks.