As an example, when I started using a password manager last year, I also made sure to start hosting …

Best practice is to have multiple Yubikeys, at least 2-3. You could leave one with a trusted person or family member. The odds of losing all of them simultaneously are slim.

There's a fairly excellent guide on creating a robust key system here: https://github.com/drduh/YubiKey-Guide . Primary and backup Yubikey for use, offline cert keys, and paper backups. If you're wanting to protect things further you can also also split your backups via a secret sharing scheme (like http://point-at-infinity.org/ssss/ ) and distribute the fragments to people or places your at least partially trust.

I think the other (IMO completely valid) concern is that you don't know what the Yubikey does, really. The protocols are open source, sure, but how sure are you there aren't back-doors in them? The firmware tends to be closed source, I found https://onlykey.io/ but I can't speak to how truly open they are, having never used them (do they have e.g. specialized hardware/software requirements for building one?) In the end, it strikes me as a security over-complication - 1. have key, 2. keep secret, 3. match key/password to situation (don't re-use keys). These dongles do 1. and 2. but miss the mark wildly on 3. You can say all you like about "backups" but in the end I actually want some things to be less secure than others - if I have to throw out a device every time I forget a password, life becomes some combination of expensive, wasteful, un-tennable, unsafe. I should never need a password…

I used to be very pro yubikey for a long time but have mostly concluded it doesn't really solve any of the problems people think it solves. It basically just provides a (1) a means to prove that you have access to a key, which isn't actually yubikey dependent, and (2) a way to demonstrate that said key is bound to a hardware device that makes it hard to steal/exfiltrate. People are incredibly laissez faire about their yubikeys - leaving them plugged in, leaving them on their keys, etc. They are an obvious DOS vulnerability. Another basic issue that key theft is actually mostly not a real attack that matters for most people. Spearphishing and faked sites are handled by any password manager worth using. If your threat is protection from key loggers, either don't use a wired keyboard or you are likely in a place where your local device is assumed to be already compromised (by the logger and…

> I don't ever want to depend on "something I have" that can't be backed up or recovered in any way. Just put one in each computer and one on your key ring and one in a safe. I have like 7. authorized_keys can have multiple lines in it.