How do I ensure I can use the same TOTP tokens if I lose my phone? That is to say, if I have a YubiKey seeded with TOTP authentication for n services, would simply installing Yubico Authenticator on a new phone and then tapping the YubiKey to the new phone's NFC antenna generate the same TOTP tokens? If not, how would I access them on the new phone?.Furthermore, that is the case if I lose the phone, but not the YubiKey.

If you handle your YubiKey with care, you shouldn't have that problem anymore.īut I am unsure how this would work. I already had to remote-lock and remote-erase a phone in the past, and losing the Google Authenticator settings is not fun. One very nice (and unclear, at first) advantage of having a YubiKey seeded with 2FA codes is that we can now generate 2FA codes on any phone, as long as we have our YubiKey with us. I have read that YubiKey-backed TOTP is phone-independent in an article titled YubiKey for SSH, Login, 2FA, GPG and Git Signing:

I have the recovery codes for all of these services, but I would like to have a second TOTP generating mechanism. But I am not sure how to back up all of my YubiKey-backed TOTP-based authentication codes. I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access.įor backing up U2F access I'm going to buy a second U2F token (probably a YubiKey depending upon the answer to this question) and register it to all my services.

Yubico authenticator