Yes, that's a security feature. It's also true for Google Authenticator, by design. You cannot officially back up/share codes because of the potential vulnerabi

Yes, that's a security feature. It's also true for Google Authenticator, by design. You cannot officially back up/share codes because of the potential vulnerabilities that a backup would open up. Yubikey has the same problem you describe. If your key stops working, you'd also be locked out. Yubikeys can spontaneously stop working in my experience. To mitigate this, sites like login.gov allow you to add multiple devices, so you can have it on e.g. your laptop and your phone, and yubikeys if you'd like. I generally do all three for important sites (or multiple Yubikey when touchID is not offered). Anyway, my point is that offering TouchID makes a more secure 2FA very, very convenient for the average person. I'm just surprised more developers haven't offered it even though it's been in Chrome for a couple years.