I understand that when using hardware keys such as Yubikeys, it is important to have at least one backup key. I’ve been told, however, that Auth0 only allows each user to register a single key. Is this correct? Or is it possible to configure such that a single user can associate multiple Yubikeys with their account?
Hey @roywaters welcome to the community!
This is indeed correct - Currently, user can only enroll 1 Yubikey. The workaround here is to enable other factors in addition to the Yubikey. This way the user can still login in a secure manner utilizing another enrolled factor. At this point if the Yubikey is lost for example, they could remove the old key and add a new one.
The ability to add multiple Yubikeys is a great candidate for a feedback request if you are interested.
Thanks for your response.
Wow, that’s rather surprising. Wouldn’t having a non Yubikey backup method basically make the account just as hackable as if the user wasn’t using a Yubikey in the first place (and only used that less secure second method)? Isn’t the account only as secure as the least secure method of authentication?
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.