I originally asked this in the FIDO-U2F channel, but there doesn't seem to be much traffic there. Maybe this is a better place to ask:
I recently was given a Yubikey, and I started to read about some of the more advanced features. I noticed that Yubico provides a service in which you can program several Yubikeys at once, and this made me wonder if someone could have programmed several Yubikeys to have the same FIDO U2F Secret? This would mean that the attacker (person who gave me the key) could now use any key in the batch interchangeably?
The paranoid side of me thought that maybe I should "reset" the device secret? A similar question was asked in 2014 and the answer seemed to indicate that this "might come in the future".
So can we reset the FIDO U2F Secret on a Yubikey 4? If so, how (I don't see anything in the personalization tool about this).
Cheers, Ian
|