This is great, if you rarely add/update secrets and you also have easy, quick access to that offsite storage. It's not so great if you're constantly tapping yo

This is great, if you rarely add/update secrets and you also have easy, quick access to that offsite storage. It's not so great if you're constantly tapping your friend because you need to swap Yubikeys again and you both just get sick of that rigmarole. When setting up Yubikey, I discovered a tool, I think it's called "paperkey" and it lets you print out a GPG key after minting it. Have fun typing that back in! OCR ahoy! It's lower-tech, but my solution is to always have a comprehensive catalog of plaintext backup secrets stored offsite. This won't rely on anything electronic and it's easy to use. You just have to make a good effort to guard it from prying eyes, at least any eyes that also know your username and password. And likewise to some of the GPs, I'm skeptical of anything based on possession of an electronic thing that functions properly. The Yubikey is the best yet, because it's simple, purpose-built, and "virtually indestructible" as the marketing copy says. I would even love one of those RSA gadgets with a built-in display for purpose-built TOTP functionality. But paper's the best backup yet. Don't discount paper!