Hacker News Reader

Other than a few awful providers such as AWS, 2FA isn't limited to a single device. Put it on your cell phone and your old phone you upgraded, or a cheap old phone, or multiple yubikeys, etc.

If one is lost you grab a second device.

View on HN

yubikeys are interesting, basically not much different than a password manager in the case they get lost/stolen, but I worry about the privacy aspect. I assume using the app, or the use of yubicloud would allow yubico to know which sites I use, and perhaps when.

Why would you assume that? You don’t need to use their app.

It looks like it might be possible to avoid leaking a list of the sites you use with yubikeys, but I need to look closer at how they work on the website's end to make sure they aren't using YubiCloud or some other third party service for validation or key management, and to make sure nothing is trackable through it. It looks like Yubico OTP requires Yubicloud and using yubico-pam might use Yubicloud.

Reply on news.ycombinator.com