That at least keeps more of your MFA key material on the hardware token and off of your phone / other shared devices.
The easiest way to do that is via the ykman CLI or Yubico Authenticator application (TOTP secrets stored on the key via either method go to the same place, so you can use both interfaces to access the same codes):
https://support.yubico.com/hc/en-us/articles/360016614940-Yu...
https://www.yubico.com/products/services-software/download/y...
So for a truly secure and reliable setup, get three. Enroll them all as parallel 2FA tokens. Keep one with you, one in a relatively easily accessible but non-obvious place, and one in a safe or bank deposit box. That way when the one you have with you breaks or you lose it, promote the secondary to your primary and order a new one to replace the promoted one.
The third is your emergency backup, for when both normally needed keys are destroyed or lost.
Now of course, this only works when the accounts you want to secure allow to enroll more than one FIDO2 token. Which is, sadly, not the most common setup still. For instance AWS only allows to enroll one 2FA token per account.
ß: Some functionality modes allow to extract private keys by design.
The service itself is free but requires an identity provider. If you already have a compatible one, you can use it at no additional cost. Otherwise, you'll have to pay for the IdP.
This setup allows you to offload MFA handling to your main IdP with the added bonus of using the same method of authentication, possibly integrated into your OS (for example if using Windows Hello / AzureAD).
At work, we use Azure AD as the IdP for AWS SSO and it works fairly well, aside from Azure's crappy (inexistent) support of security keys outside of Windows.
There is one gotcha with an easy workaround: the SDKs don't usually support the login part of the SSO flow, and sometimes don't support it at all (terraform comes to mind). To work around this, I'm aware of two tools you can use:
* aws-vault [1], which I personally use and works great for setting the required environment variables, no need to actually have it handle any sort of key
* aws-sso-util [2], which I've seen recommended but never tried
---
[0] It may be an issue if you need to use the managed ActiveDirectory service, which needs to be in the same region
