0

I just received my YubiKey and was playing with it. It works brilliantly but I couldn't help thinking what would happen if I would lose the key. Well, for Google you can print out some backup codes, so that's covered. But then I wanted to simulate a lost key for Amazon AWS. Apparently there is a page that allows you to troubleshoot your MFA key, see screenshot:

Yubikey login AWS

However, in case of a lost YubiKey, I would now click cancel or press escape. Next, the screen quickly changes and the "Troubleshoot MFA" link is not present anymore! In addition, I can't click on it when the message pops up.

How am I supposed to recover my account if I can't click on the link? Anyone with some tips?

2

This is a general question from AWS. It’s something I covered during my security specialty exam, I will try to dig more info, but:

  1. If you are an IAM user, you can contact the admin/root user, and they can disable MFA for you.
  2. If you are the root user, you’ll have to contact AWS support.

It doesn’t help that AWS does not allow you to register more than 1 yubikey per user. You’re stuck with a maximum of 1!

2
  • 1
    thanks, unfortunately, I am working from the root user perspective. I was a bit a newbie when I started all AWS stuff so I am stuck with that. But do you agree on the fact that it's a bit strange that there is a link to "troubleshoot MFA" that is not clickable if you cancel your MFA response? I would think that is a major design error.
    – helloworld
    Jun 30 '20 at 15:49
  • Yea, sounds like a bad UI design. Jul 6 '20 at 1:27
1

Disable U2F support in Mozilla (the opposite of - https://support.yubico.com/support/solutions/articles/15000017511-enabling-u2f-support-in-mozilla-firefox)

This will prevent the Windows Security window from popping up. Then you can click the Troubleshoot MFA link.

0

The only general answer to this is probably that you will need to contact the support team for the respective site. Different companies will likely have different policies and procedures on how to carry out account recovery.

1
  • I understand and that is also something they recommend if everything else fails. But in this particular case, they have another route to troubleshoot the MFA which is not accessible because of the inability for a user to click the link.
    – helloworld
    Jun 30 '20 at 12:59
0

Yubico also sells keys in pairs. When you register an account, register two keys & keep one in a safe.

Reading the AWS Docs I do notice that they only allow one Key per account. One solution would be to authorize a 2nd Account, using your 2nd key, for that VM. Perhaps the root user gets the "backup" key you keep in a safe while you use a delegated account and your daily key for "normal" work...

Anything else would require you proving your identity to the company with which you have the account. That's never fun.

3
  • You mean one key with the same output? Because I actually purchased two keys but I cannot register 2 keys at AWS. If I look at the "Manage MFA device" options, I can only remove the current key and replace it by another.
    – helloworld
    Jun 30 '20 at 13:01
  • @helloworld That is unique in my experience. (Not an AWS user) Every site I've used has allowed registration of multiple U2F keys. I have seen single 2nd Factor registration for Authenticator Apps, but in that case I use Yubico Authenticator and record the same shared secret to both keys...
    – tjd
    Jun 30 '20 at 13:14
  • agree I also find it not logical. I would rather have a system like Google where there are some readily available backup codes.I even purchased the 2nd yubikey for the purpose of having a backup key. Perhaps I will still use it for Google logins
    – helloworld
    Jun 30 '20 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.