Physical 2FA tokens, such as smart cards or YubiKeys, are becoming more popular in large companies for authentication purposes. However, one issue with them is availability: When a physical 2FA token is lost or gets broken, the user is by design not able to authenticate anymore.

How should a company manage their physical 2FA tokens to ensure employees who lose their 2FA tokens can get access back as soon as possible?

Here are some possible solutions I thought of:

Keep some empty tokens as backup

By keeping a handful of empty tokens as backup, these can be personalized by IT relatively quickly, and should allow the users to continue working. The downside is that, given the current situation forcing many people to work from home, employees may not be able to pick up a new token immediately, which can lead to significant downtime.

Give everyone a second token

Basically, employees are given two tokens (let's call them "primary" and "backup" tokens), and told to keep their backup tokens in a safe place. Should the primary token become unavailable due to loss or malfunction, the secondary token can be accessed rather easily. The downside here is that this essentially doubles the cost for 2FA tokens, while also increasing attack surface.

  • 3
    Tell people not to lose or break their tokens. Who does that anyway? Commented Jun 10, 2021 at 13:50
  • 1
    @ConorMancone I broke a YubiKey not long ago. Some of the early batches of that particular model were apparently not made strongly enough and prone to cracking plastic. They replaced it for free, and I fortunately caught the problem early enough that it still worked even though the circuit board was exposed. But no matter what you tell people, some are inevitably going to get broken or lost, as with any other object. Commented Jun 11, 2021 at 0:29
  • 3
    Don't worry @ZachLipton, that was 100% sarcasm: breaking and losing things is absolutely inevitable, and it's literally the job of security systems to account for human mistakes as best as possible. Commented Jun 11, 2021 at 10:04
  • Re 2nd tokens for all: If you give everyone 2nd tokens, they have one more possession (which they hardly ever use!) to track, and may not notice within weeks let alone minutes if its missing or used until too late. If you don't, and your solution is to disable 2FA pending arrival of a replacement token, that's insta-exploit territory, an attacker makes that happen specifically to exploit the predictable gap. So neither of those are brilliant, IMO, as they stand. Perhaps a 2nd token, but disabled until manually activated following contact and verification of genuineness? Or something else....
    – Stilez
    Commented Jan 17, 2022 at 4:09

1 Answer 1


The common practice is to be able to ship a replacement token ASAP to the user. Spares or being able to drop-ship from a supplier are common approaches.

You invalidate the lost token, and remove the need for 2FA for that user, and add in additional protections to limit the risk in the meantime. Then walk the user through setting up the new token when it arrives.

Giving people 2 tokens is silly. It's crazy expensive, and you expand the attack surface. If the "backup" token is lost, would the user have visibility of it? How long would a backup be lost before it was noticed?

Best option yet is to use soft tokens (apps). They can use spare or backup equipment, or even a PC-based app until an acceptable option is put in place.

FIDO released a Token Lifecycle Whitepaper (April 2021) with a section on practices to consider for lost tokens (page 6). It says what I say above.

  • Thank you for the comprehensive answer. I am aware two tokens is suboptimal, but unfortunately, some people swear it's the best idea.
    – user163495
    Commented Jun 10, 2021 at 13:09
  • 2
    And for some risk contexts, it might be the best option. Crazy expensive and you need tight controls over the backup key, but potentially the best option in some cases.
    – schroeder
    Commented Jun 10, 2021 at 13:11
  • Nuance: if this is the only use of soft tokens in your environment, make it clear that they are only for temporary use - ideally, by having them automatically expire on the server side (so that no one has to remember to expire them). Commented Jun 10, 2021 at 15:16
  • 4
    Re two tokens: The main reason you do that (and by "you" I mean "Google") is so that you can tell employees, IT, etc. "No, we will not make an exception and turn off 2FA just because you lost your key, got a new device, etc. If you need an extra key or keys, we will overnight them to you, but every employee must authenticate with 2FA every single time on every single device." If you are stingy with keys, and allow users or IT to "temporarily" turn off 2FA, policies will get bent and reinterpreted until users feel that they can get their jobs done.
    – Kevin
    Commented Jun 10, 2021 at 23:55
  • 2
    This new (June 2021) FIDO Alliance whitepaper may also be relevant - "FIDO Authenticator Lifecycle Management for IT Administrators": fidoalliance.org/… Commented Jun 13, 2021 at 6:53

You must log in to answer this question.