YubiKey provisioned with a challenge-response secret turns a passphrase into something you know plus something you have — guessing the passphrase alone is no longer enough.
Enable “Protect with YubiKey” when creating a block or standalone archive — restoring then needs provisioned YubiKey as well as the passphrase.
Derived passwords and Bitcoin wallets have no passphrase-only mode — the YubiKey’s answer is one of the three inputs they are derived from.
Blocksets are designed to be recovered with enough blocks and the shared passphrase, nothing more — a YubiKey would add a third requirement.
YubiKeys provisioned with a challenge-response secret protect blocks and archives in the app and power derived passwords and Bitcoin wallets in the terminal. Provisioning is done using command-line interface.
Run provision-yubikey once per YubiKey — a challenge-response secret is generated, written to a slot and verified.
See guide →Secret is shown once and can never be read back from the YubiKey — back up secret in a block or provision a second YubiKey. Without provisioned YubiKey or backup, protected blocks, archives and derived secrets are unrecoverable.
See guide →Only YubiKey models with OTP interface can be provisioned — Superbacked uses HMAC-SHA1 challenge-response, which the Bio and Security Key series do not support. Slot 2 is used by default, leaving the factory Yubico OTP credential in slot 1 intact.
For high-stakes secrets, use Superbacked OS — a hardened operating system that runs offline and persists nothing to disk.
Copyright (c) Superbacked, Inc.