Author here. Explain to me why I should be permanently banned from Uber because I accidentally forgot the secret key to log in to my account.
You shouldn't, but your headline doesn't attack Uber, does it? Perhaps it should.
I understand you’re frustrated, and clearly, Uber not allowing you to create another account is the crux of the issue here. That and the fact you didn’t save your backup codes.
For what it’s worth, I use 2 yubikeys that are either used for webauthn or TOTP. In addition, I write down every single backup code (yes, manually) in a notebook. This is in addition to my passwords being in a password manager.
If I lose my primary yubikey, I still have a backup one. I just need to go recover it (which, granted, requires me to go back to $HOME_COUNTRY first). If I lose both yubikeys, I can still recover accounts with the backup codes. If I lose all three, then yes, I am fully aware I won’t recover the accounts. That’s exactly as I designed it.
The correct advice to retain from this event is: test your backups. Your backups are worthless if you never check their contents. You are absolutely right: if you lose the backup codes and then lose the 2FA access, you’re screwed. The only way around this is to verify whether you have the backup codes on a regular basis.
I lost my phone, though. There's no prompt they could send me.
> I believe Google can send a similar prompt to YT or GMail apps
There was no phone, anymore. No way to prompt.
As for my Google and GitHub accounts, if they're not associated with a phone number or recovery email address, I fully expect to lose access permanently if I were to lose the codes. In such a case, I take responsibility for it.
No. Phone number is not associated to a person for a life time. It can be "rented out" to someone else if stopped being used. However an "account" is (as has credit cards and such). So phone number cannot identify an account solely, without anything else in addition.