You can have multiple second factors. I have 2 YubiKeys (one on me, one in a safe place) and then I have the standard TOTP codes on my phone using Authy.

If I manage to lose my phone, live and backup yubikeys then I have recovery codes.

It's going to have to be something pretty drastic to cause me to loose all of that.

No, we're here with you. I'm also wondering if being responsible for storing and using passwords is THAT BIG OF A DEAL??? Even mathematically, probabilities of two failing points are adding. I've been locked away from mail, banks and gods know what else just because I didn't have my phone or computer nearby, was in different country, in a place without network coverage, haven't paid for cell in time, etc. etc. etc. and absolutely positive that 2FA (at least that requiring on-line presence) is evil. The ONLY THING that can really protect and help you - is good HUMAN tech support. Where you can call, explain yourself, prove ownership and regain access to a service. Up to the point of having to go to of video-call office yourself and beyond. Yeah, I'm completely aware that some corporations don't even have humans (hello, Goolag!) employed - and trying to stay clear from them.

Well, I've lost control of accounts and I suspect a few of us have. Fortunately the one I lost wasn't important.

But my response wasn't to turn off 2FA. It was the reverse - to turn on all forms of authentication made available, for all acccouts. If I lost control of it one way, I had another.

By the by, if you read the spec, FIDO expects you to do this in preparation for the day you lose your token. So no you are not the only one - people think about it all the time.

What people should do is have a small SD card with all of their private keys and passwords stored away safely. This SD card should be kept in cold storage (e.g. in a safe where you keep personal belongings), and never be accessed unless in absolute emergency (lost your YubiKey etc and can't get in anywhere, etc.)

SD cards are horrendous for long term storage. Probably the worst medium for such a task.

What is the best? Cursory googling suggests SD cards last ~decades at normal usage [0], and in this context where it's barely accessed, maybe longer?

[0] https://www.sdcard.org/consumers/faq

Probably depends on the quantity of data. If you're talking GB's or TB's of digital data, then maybe "archival grade" DVD's or BluRay's.

https://www.verbatim.com.au/product-category/data-storage/op...

If it's instead just a few short strings of text (eg GH password recovery codes), then you could use physical storage.

eg engrave the codes into something that'll survive extremes (granite?), and keep them in a fire proof safe.

Or something along similar lines. Probably don't engrave into glass though, due to that potentially shattering in some situations.

If you go to bluray.com you probably can read the same only for blu-ray.

Better search for a neutral source.

I wrote some scripts to generate QR codes, then printed them to photo paper.

https://github.com/alexjh/gpg-backup/blob/master/Makefile

Back then I thought that QR codes were a bit of a gimmick but now I'm way more confident that I'll be able to read them in the future.

My choice are 8cm DVDs of decent quality. And inability to quickly overwrite/damage your data is a bonus.

laser print

Do most people have a "safe where they keep their personal belongings"?

i guess it would presumably be on-premises, because you're going to have to take it out to add recovery codes to it every time you add a new TOTP or whatever (or create a new private key or password) right? If it was, say, a safety deposit box at a bank, odds are it's not gonna wind up with most of your stuff. Even on-premises, the task of making sure "cold storage" stays sync'd with my evolving passwords, private keys, TOTP recovery codes, etc, seems like something I'm unlikely to keep up with.

I have an IronKey for this purpose.

For that there are the revoke code. And the backup phone number.

Or even better than the one time codes they give you, you can simply store the secret itself, on a piece of paper in a safe.

easily solved by adding multiple MFA options, e.g. multiple security keys.

Github has alternative recovery methods though too, such as 2FA over SMS.

And support can help out as long as you can show that you can ssh into a github host using the private key of one of the public ssh keys assigned to your account.

That makes some sense, and seems to me a nice option. Is it documented anywhere that that is an option, that they will do that?

Documented here:

https://docs.github.com/en/authentication/securing-your-acco...