> This seems like that nightmare scenario on steroids. I'm an oddball in that I'm using a U2F (for SSH) / webauthn (Google, domain name registrar, etc.) device

> This seems like that nightmare scenario on steroids. I'm an oddball in that I'm using a U2F (for SSH) / webauthn (Google, domain name registrar, etc.) device on which the master key can be reset. It's a tradeoff: I now better make sure nobody steals my "paper seed" in the real world and I better make sure I don't lose it [1]. But in exchange should I lose/break/someone steal my device (which is protected by a PIN btw), I can initialize a new one. Now there are schemes (like m out of n) where you can distribute, say, part of the paper seed to several siblings/family members/friends or store a part in the safe at the bank, etc. Making it highly unlikely you'll ever lose access to your master paper seed (which is a list of 12, 18 or 24 words out of a vocabulary of 2048 words). As a bonus the device has a tiny screen which tells you if you're registering to a new service or authenticating and tells you the name (if it's a known service, hardcoded in the device) and/or ID of the service you're authenticating too. It is protected by a PIN. It has a plausible deniability feature where you can unlock a fake master key. And I can buy as many of them as I want and initialize them all with the same seed and then hand them to family members/friends/put one in the safe at the bank. They're all protected by a PIN anyway. So if my house burns down, I'm not sorry out of luck: I can be back in business immediately (i.e. without needing to order one, wait for it to arrive, then find back my paper seed and reinitialize it). Originally it's a cryptocurrency hardware device but I don't care about that. The CTO of that company was part of the original FIDO alliance. The device I use is a Ledger Nano S (cost $79 bucks or so) and I load one "nano app" on it, the "U2F" one (works for SSH and works for webauthn). Now I don't know exactly what's going to happen now that Google, Microsoft and Apple are teaming up to embrace FIDO2 with their new "passkeys" standard (which AFAIU ain't 100% finalized yet). From the testing I did it looks like Google removed the "counter" verification from their site, which allowed to detect cloned security keys. They used to check for clones, but don't anymore (or at least don't warn the user anymore). I'm nearly sure this removal of clone detection is related to the upcoming "passkeys" thinggy. I don't know if the older U2F devices (which are compatible with Webauthn as Webauthn is only a server side protocol change) shall still be usable once the "passkeys" is finalized: if anybody has infos on this, I'm all ears. Meanwhile SSH since 8.2 can use all U2F keys (including the Ledger Nano S) and that is a godsend already. [1] although if I realize I lost my "paper seed" and I still happen to have my FIDO2 device (or any cloned one I prepared in advance), I can enroll a new device so I'm not totally screwed. And I'll had that many people using a security key that cannot be clone do still use "backup codes" they write down on a piece of paper, which is not safer than writing down a list of words allowing to reinitialize a FIDO2 device.