raccoondad What will you do if your HW key breaks?
You should never have one single key. Have multiple, in multiple locations you frequent, and at least one with you at all times.
When setting up OATH creds, do not just use an app to add it with the QR code. Read the code, extract the secret and settings, apply the secret to each of your keys, and encrypt and save the info in a secure, offline location. I have a script that parses a list of secrets and adds them to my YubiKey so getting all of them updated is super easy and quick.
When setting up FIDO creds, have all the keys in your possession and add each one to the service. Any service worth their salt allows the addition of multiple distinct keys. You can also add other ones not in your possession at your leisure, though it's easier to do it all at the same time, and better that way so you don't forget to do it later.
HOTP and other iterated challenge-responses are difficult to manage as it can get out of sync between the keys. Best set it up separately on each key if possible, but most services do not allow you to do this. I would argue against HOTP anyway, use TOTP where possible, otherwise use a password manager that is secured with TOTP or better MFA.
raccoondad What will you do to make sure it works with each device you use?
Bit of a misnomer, as the technologies used by your average security key are designed to cover all bases.
- For services and devices that support it, use FIDO2. Be warned of the recent security advisory, though that attack vector is not a worry for the vast majority of users.
- Else, or if feeling insecure, use TOTP + password.
- Else, use FIDO or U2F. Clunky solutions but still secure, though may be vulnerable to the side channel attack as well.
- Else, use a password you know + static password on the key. Least secure as it cloneable, but still requires physical access to the key if the password hasn't been compromised. Better than nothing.
Any of the solutions using a password can be made more secure by the introduction of a secure password manager, of which can be protected by a hardware security key.
There is also Yubico's proprietary attestation method that requires the service to connect to Yubico's website to validate a secret expressed by the YubiKey—but no one supports that and I don't like a third party being involved, so I explicitly disable that on all my keys. But hey, that's also an option.
If you use TOTP, you only need your phone, since you can get the OTP from the phone and type it into the device you're authenticating on, so compatibility there really isn't an issue. FIDO[2]/U2F does introduce issues as the web browser/device you are signing in with must:
- allow USB/NFC access
- support the protocol used (i.e. FIDO[2]/U2F)
- have the drivers installed to interface with the device over USB/NFC using the chosen protocol
- All Windows devices past 10 do by default
- Linux may require manual work
- Modern Android works fine
- idk about Mac and iPhone but I hear it sucks