So you've moved the worry from losing/breaking your phone to losing/breaking your YubiKey?

Sure. I have a backup key but yes, you can't get MFA without adding a device that you may lose; whether that's your phone or a key. Like I said I prefer a key because I can't put my phone on a chain around my neck or on my keychain.

I keep a second key as backup for this reason, which honestly is overkill and I only do because I got a second one for free at a conference. Easier solution (which I also use in case I someday need the second one only to discover that the blue smoke leaked out) is to just print out the TOTP secrets and keep them somewhere. I'm usually printing out recovery codes when I get a new TOTP secret so this has never felt like a big deal.

Also easy enough to maintain a keepass[xc] vault for totp secrets, you could keep a separate one from your passwords if you were feeling paranoid. Great support on mobile and desktop for using a keepass db as a TOTP source - and easy to sync with dropbox/email/ssh/your web server/whatever

Everyone should read this risk mitigation solution for loosing 2FA. I always think about printing recovery codes, but having keepass vault with those codes also sounds great. You may even have some random password there and store it printed out in some locations just for emergency.

Anyways, people should think about these risks when dealing with 2FA: flood, fire, stolen, lost, (I) broke (Smartphone, yubikey, usb, etc), broke (itself), software bug, kids, washing machines, etc.

And also something we usually don’t consider: loss of memory, which can occur in combination with a traumatic event like your house burning. Then you can loose your smartphone, your Yubikey, your printed copy, and your memory all at the same time if everything is stored in one place. And this is exactly when you will need those the most. Not easy to defend against such a nightmarish scenario.

who says you only have one or no other backup?

anyway I wouldn't but s Yubikey for TOTP. OTP sucks. Sure it's better than no 2FA and TOTP is better than SMS OTP still it's not grate.

WebAuthn-like auth can provide all the benefits of TOTP while being way more secure and in some cases even not convenient.

The main drawback is how to backup your 2FA which makes it less of a choice for a "casual" user.

The only downside is limited space on Yubikey.

I am currently carrying 2 tokens :(

Up to 32, for those reading who (like me) didn’t know about this limitation.

https://support.yubico.com/hc/en-us/articles/4404456942738-F...

Good luck finding 32 places that accept Yubikey.

They don't have to accept Yubikey, they have to accept TOTP. Which ~everything does.

except eBay

Or Google, very user hostile because it makes me choose between giving them my phone number or installing their spyware app on my phone.

I use Yubikey USB to authenticate with Google.

Google's authenticator is just a standard TOTP app. You can use any app, including Aegis.

Google hides TOTP option until you create a method that uses your mobile number or google app. Only after that you can change it to TOTP.

My Yubikey always loses its credentials. (If anyone else knows about it and have a fix I'm all ears.)

I guess I need a new one, but what I want to say is don't rely on a single Yubikey or even two. Do have backups.

Which model do you own and how does the loss manifest?

The single-tap and long-tap don't produce expected output? Can you share more info on it?

I own many Yubikeys (due to research I've been doing in 2017.) and I had many Yubikeys to play with, for TOTP/HOTP/U2F purposes, even using it to unlock Windows and I haven't had a case of a Yubikey basically deprogram itself. I washed them in the washing machine, ran them over with my car, thew them in mud piles and they always worked without a fault so your case is a surprising one.

Judging by what you wrote, unless there's some weird NFC communication going on between your phone and Yubikey (are they in proximity?), I'd say it's faulty and you need a new one.

Classic USB. Plastic. (I don't know the exact model, I got it from work.)

After adding a site or a computer it works a few days and then suddenly when I try to use it with my phone or computer I just get an error about no <something>.

So yes, probably defective.

Not enough info to even guess what might be wrong, but I'd assume it's defective and I'd try with another key as well. I wish you good luck with the next Yubkey you get! :)

Btw. this is the first time I've read on a public forum that someones Yubikey is defective, they are really well made and I didn't manage to break one via regular use and bad maintenance.