I use keys as my default way of login but I have 'phishable' backup methods (OTP codes or backup codes). For me, the main thing is that using the keys by defau

I use keys as my default way of login but I have 'phishable' backup methods (OTP codes or backup codes). For me, the main thing is that using the keys by default make my accounts more secure and I would only use the phishable methods in case of emergency (if my house goes up in flames with my keys, computer, mobile, etc). One important thing for me was to remove my mobile number for SMS OTP or password reset, as sim cloning is a posibility. And a password manager is still indispensable as most sites don't accept hardware keys at all.