As for theft, if you’re using your yubikey as a 2nd factor then they still can’t log in because they don’t know your password. If you’re using your yubikey as both factors then it either has a PIN or biometrics, so the thief can’t log in.
My main use for my yubikey is for SSH. I have PIN-protected SSH with a private key that can’t be exfiltrated
Appears that while they couldn't fix it, they have gone ahead with a workaround and made multi-device 2FA support a feature in a potential auth replacement system.
Must have been a particularly frequent and loud complaint.
One of my keys failed spontaneously after a just few weeks in my pocket, on a ring with my other keys.
I decided to stop using yubikeys. A password manager has worked very well for me ever since.
I use a password manager, but my Yubikey has all my 2FA. Including TOTP.
How does this work? Do you have to physically retrieve both any time you sign up with a new service?
If that's how it works, it sounds like a choice between two bad options: either having both of them handy at the same time, hurting redundancy, or registering them at separate times, hoping you remember to do both. Is that the case?
You will have to retrieve your key when you sign to a new service. at this point you risk losing both.
or are you saying you cloned the private keys and know how to correctly advance the counters when you need the backup?
Since I use my Yubikey for SSH, I’m frequently adding both Yubikeys as authorized keys on machines. But I keep an authorized_keys file with both public keys so I don’t need to physically grab my backup
This way, you don't need to have two yubikeys on hand and register them both on every new site. But in case you lose, it's not impossible to create a new one. Yet, obtaining the key from the hardware token shouldn't be any more possible than with the current system.
Most people will never understand this subject, and the fact that they don’t need to is a good thing. If you want a hobby, great, you can go figure out how to do that. The default needs to be safety.
But like I said in the comment below, I suspect these vendors are only here for vendor lock-in and targeted advertising. And the websites enabling webauthn are likely to require you to use a vendors app/service. Like banking sites today not allowing me to utilise keepassxc totp functionality trying to force me to download their app or SMS.