I have a Fidesmo card, and 2 Yubikeys that I keep my TOPT keys on.. I add new keys to all three so they are triplicate copies and store them in different locations.
Today I found out the Yubikeys have a 32 key limit.
While I would love to have my Apex installed at some point since I bought it like 3 years ago, I think I might need to find a new solution. I would not be against dumping everything to have 3 of the same devices. I only use if for TOPT codes over NFC.
There’s shouldn’t be a number based limit, it’s just based on how much free space the implant has:
It’s been a while since I added a new account to mine, but I think each one is less than 1%, so you can fit quite a few, especially if that’s the only applet you have on your apex
Also, it’s been mentioned here that you can save a copy of the QR code used to register the TOTP account instead of having to keep an entire authenticator device as a backup, if that might work as an alternative for you
the only limit is memory on Apex. if it fits it fits.
did you deploy fidesmo’s otp app to this card? it may still have this limit. it also has code in it for no-auth reset so anyone could send a specific apdu and nuke your keys, even if you have a passphrase set (reset does not check). the vivokey version does not have this.
Yeah I think I did have the fidesmo app on my phone at one point. Probably deployed it there.
No passphrase set. I would think nuking my keys would be the best thing someone could do to it if I ever lost it.. lol. Either way I have 2 other backups.
Does it make sense to just buy the JCOP card and deploy the OTP app to it?
no i mean fidesmo’s OTP applet to be deployed to the card.. their OTP applet has the shit code in it for reset.. and probably the 32 key limit as well
Considering your historical contributions to VivoKey, I’d be happy to send you an Apex implant or Apex configured card (I have a couple test cards kicking around my desk). Let me know what you want.
yes correct. this is the trade-off. removing reset for apex users doesn’t remove the ability to reset, it just removes a glaring open DoS attack common to all yubikeys and OTP authenticators using that AID. not impossible for an attacker to use the fidesmo api to attack an apex and remove the application but 1) much more complex, 2) logged interactions with servers, 3) takes far longer time to achieve (nfc device must be in the field much much longer).
no i mean fidesmo’s OTP applet to be deployed to the card. their OTP applet has the shit code in it for reset.. and probably the 32 key limit as well
I have way more keys on the fidesmo card than the yubikeys ( i started with the fidesmo). I assume I used the Fidesmo android app to install whatever TOTP app they had listed there.
