For all critical services like gmail/github I use security keys, and I have multiple of them.
Reply on news.ycombinator.com