Hacker News Reader

Comment by chasingthewind | Hacker News Reader

I actually associated a Yubikey to my account because I was so annoyed at this problem. I wanted a better backup plan than the physical printed codes idea. I didn't realize that a better 2FA app would have solved this :P

View on HN

Not everything supports Yubikey/FIDO U2F at this point, so that wouldn't work for everything, although I do have one. My Gmail account itself is behind a Yubikey (and a a backup Yubikey), not a 2FA app, because I'm trying to avoid a Game Over scenario. The Gmail address is the recovery address for my password manager account, so getting that pwned is basically the keys to the kingdom for every other account.

I realize not everyone wants to leave Gmail, but another reason I'm thinking of using tutanota aside from e2e encryption is you can create a second user that's tied to your master account. You can reset the passwords of your sub accounts from the main accout if they are compromised.. of course you have to pay for multiple accounts though.

The weird thing is: Yubikey was the only option for me in Gmail. Only after I associated a Yubikey with it, was I able to also use an authenticator app.

Does anyone know if this is normal behaviour, and if so, what the reasoning behind it is?

That's weird, probably a glitch. TOTP is the basic option.

Having printed access codes in your safe doesn't seem worse than a backup Yubikey in your safe? Maybe better, since electronic devices can break.

Either way, put it in a tamper evident envelope in the safe.

Reply on news.ycombinator.com