I attempted to use a Yubikey with GitHub, but when I tried to enable it, Windows gave me an on-screen "soft" 2F dialog instead of making any use of the device at all.

Seems related to something called "Hello"? Either way, I haven't found a way to disable it. Caveat emptor.

Because GitHub obeys the part of the spec. which says sites need to allow multiple credentials, you should still be able to get where you're going (I haven't seen this "Hello" pathway) via a circuitous route.

1. Let the Hello stuff happen, GitHub will propose that you name it, why not "Hello".

2. Tell GitHub you want to enroll another token. The system will automatically disregard "Hello" because that was already enrolled, so this time it will enroll your Yubikey or whatever other tokens.

3. (Optionally, if you don't want "Hello" e.g. because it isn't your Windows PC you just borrowed it) Tell GitHub you want to remove "Hello".

With which browser?

This was a while ago, so I don't quite remember. Either Chrome or Firefox.

Go for it. They're inexpensive, handy, and easy to set up and use. I currently use it for everything from logging in to my laptop and using sudo (via PAM) to SSH (gpg-agent) to logging in to GitHub and other sites (via U2F).

I'm still very confused as to how the hell they work. Do sites need to explicitly support them? Can I just use it for 1Password?

Also I am a bit of a scatterbrains so prone to losing things. What do I do if I lose my YubiKey, are there recovery options?

Do you use it in addition to an authenticator app or instead of? I am really confused as to the advantages it gives.

> Do sites need to explicitly support them?

The web site will need to support FIDO U2F, yes.

> Can I just use it for 1Password?

I've not used 1Password, so I don't know. The Yubico site should be able to tell you if a given thing is compatible.

> What do I do if I lose my YubiKey, are there recovery options?

Nope. Get two of them.

> Do you use it in addition to an authenticator app or instead of?

Sort of both. So if a site supports the use of an authenticator app but not FIDO U2F, I use the Yubico authenticator app. When opened, it stays locked until my Yubikey is tapped against my phone.