alt Hacker NewsHow could this information be surfaced in a reasonable way in administration software?
Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".
Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new session for him on the provisioning portal (so he can enroll the new key) but now his fingerprint is "Interesting Elephant". What do I do with this information?
It might be better to log the exact forensics and show the administrator the differences, e.g, "User has a new font called "my_handwriting.ttf" since a week ago", or "appears to be a totally different processor, and the new system has Russian fonts installed".
> Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him
They should be authorized ahead of time.
> What do I do with this information?
Not much. You can't authenticate a person using their (public) fingerprint information.
Your problem boils down to: "How can I verify someone's identity over the internet". You can exchange emergency recovery codes ahead of time (e.g. in an envelope), you could trust public keys from both of their yubikeys, but they can be stolen.