aunterste

I just 'aborted' my Yubikey purchase again as I started to think through how many I would need to buy and where to leave them to be sure I always have access, even if my house burns down and/or the hardware key breaks, one gets lost etc.

I think hardware 2FA is great in a corporate environment where there is an administrator that can enable/disable accounts and issue a new HW key if required.

For personal accounts though, I somehow feel uneasy about reliance on a small piece(s) of HW. Having a great password manager, lots of 2FA (with TOTP, where I own and back-up the secrets) and have all of that secured with a cloud backup with a super strong password that I don't know or have to write down, but can recreate if need be (e.g. an MD-5 hash of a specific segment of a public text).

Too much? Anyone else has the same concerns or am I missing something?