I learned the other day that FIDO2 keys have a counter so that if an attacker does manage to clone the key, and both keys continue to be used, the counter for them will desync and the server can detect the clone.
Pretty cool, wonder how that plays out in practice.
Conversation
Like I'm pretty sure the recommendation is allow for two keys but AWS still doesn't, so I'm a bit doubtful that the average backend is detecting/ handing this, but I'm certainly curious to hear otherwise.
2
2
Replying to
Should allow for more than 2 keys since adding more keys is the best way to offer recovery.
My Google account has 3 security keys: YubiKey 5, Trezor Model T and Pixel 5 Titan M.
Can restore Trezor by fetching 2/3 Cryptosteel backups and setting the 2FA counter to Unix time.
2
1
Replying to
So in this case (with Trezor) you're cloning the seed/ counters across devices? I'm not super familiar with that system.
1
Replying to
Trezor generates a high entropy seed as a BIP39 seed phrase (they created the standard) and has you write it down or physically store it via an approach like cryptosteel.com and enter it again to confirm.
You only need the seed phrase to recovery if it's broken or lost.
You wouldn't normally clone it. You have a way to recover if the hardware gets broken or lost somehow though. U2F/FIDO2 won't start working again with sites enforcing the counter until you set the counter higher than it was previously though. Setting to Unix time is an easy way.
2