> But what happens when you lose that security token? It's really not that big of a problem, at least in the "paranoid nerd" context. Just have backup keys tha

> But what happens when you lose that security token? It's really not that big of a problem, at least in the "paranoid nerd" context. Just have backup keys that your users can print out and keep in a safe place. Or have more than one U2F device - most implementations I'm aware of allow users to register more than one device. Of course, for most applications, there'd still be the usual support backdoor. That's definitely a problem not quite as easy to solve.