Keep two or three, put one in a bank or a safe at home. That should be enough redundancy for most people. As long as you can still get in to revoke/enroll stuff you should be okay.

It’s not so much a problem as it is a balance of security, redundancy, and effort. You decide where you want to be on that balance of considerations.

Safe deposit boxes aren’t safe: https://www.google.com/amp/s/www.nytimes.com/2019/07/19/busi...

> Keep two or three, put one in a bank or a safe at home. That should be enough redundancy for most people.

Yeah, good luck.

I don't know of any system that lets me enroll 3 security keys for an account.

Doesn't Google let you set an arbitrary amount?

Yes, as does Github and Facebook. I forget whether AWS does.

Get 2 keys, keep one in a safe place. Add both to your important accounts.

Then also setup TOTP, so if you lose both keys and have a working cell phone with the app installed you can still login.

That's if important accounts allow you to do that. For example AWS only allow one MFA key

I have one at work/keep on my computer and one at home.

Some websites allow TOTP which is still safer than SMS, but if I lose one, I'll get another one while I use the 2nd.

> I have one at work

This seems really easy to steal.

> one at home

Most people I know have been burgled too.