For example, given a Yubikey which generates OATH codes (such as with the command ykman oath accounts code 'accountname'), and two different accounts set up on that Yubikey, can a given website/provider (or two different sites under the control of a single person/company) know that 2FA authentications for those different accounts are being done with the same physical Yubikey?

New contributor
Pistos is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 1
    No. Every account have an unique key. It's not possible to know if they are from the same key, from another key, or from a simulator.
    – ThoriumBR
    2 days ago


Your Answer

Pistos is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.