Comment by the__alchemist 20 hours ago
I'm perpetually worried (and partially prepared) for this sort of scenario, as more of my accounts require 2FA. I dread the day I lose or break my phone, have my items stolen, there's a weather disaster etc. I try to make my hobby repos public and/or backed up in multiple places as a hedge.
The problem with this tactic is the need to go get the Yubikey every time you make a new account.
Actually, this is now a solved problem. Root-of-trust pattern.
- Use Bitwarden or similar
- Set BW to recognize the Yubikey as one (of several, incl. TOTP ('Authenticator') code) second factor.
- On all other sites and services, generate passkeys (which are essentially virtual yubikeys) and save them in BW.
- In BW, save the password and TOTP. BW itself, on another device (or in a separate incarnation - e.g. the desktop app when authenticating the browser extension) is now your everyday means of authenticating to BW.
- BW-stored passkey is now your standard means of authentication for e.g. GitHub, Google, etc
- Put the yubikey in a safety deposit box
- Bravo, you have a very professional trust system
Just do as I do and keep all the 2FA TOTP Codes in your keepass.
All my digital life is sorted with a password manager that sync's in a cloud (I know some consider this an anti-feature). I guess OP probably had to disclose information to someone (s)he trusts when going to prison and that trust was abused.