I use a password manager to store my credentials, TOTP codes and stored secondary codes. Yes, that does make my password manager more of a risk, but for that re

I use a password manager to store my credentials, TOTP codes and stored secondary codes. Yes, that does make my password manager more of a risk, but for that reason, I use a strong and unique password for the password manager, have a password manager that has its own security key that is required for access from new devices, etc. When I transfer phones, all that stuff comes with me. For worst case scenarios, I have a few spare YubiKeys setup that I can use in the event that something goes haywire. And in a safe deposit box, I have a YubiKey and a printed out copy of my 1Password emergency kit. So that if someone drives into my house and it burns down, I do have an option. But I agree that this is a lot of stuff to keep track of. That’s why I’m glad that Passkeys are being adopted by the big players (Apple, Microsoft, Google) and that we’ll see consumer rollout of this sort of thing, which should make this a lot better. There’s no such thing as a system without a threat model — and biometrics can be imperfect, but I’m much more comfortable with that or even relying on my current MFA setup than I would be using SMS 2FA or no 2FA!