> Registering a new key will hopefully also trigger a big scary warning email/SMS/fax to me and/or additional security contacts If your devices are compromised

> Registering a new key will hopefully also trigger a big scary warning email/SMS/fax to me and/or additional security contacts If your devices are compromised you are not guaranteed to receive any emails or SMS. There are malwares known to remove emails and messages either directly or by running as man in the middle or by intercepting and modifying the UI. > As a user, I sure hope there is – it would be genuinely frightening to know that my account is unrecoverable if I lose all security keys linked to it! As a professional I am reading it the following way: "The access to the account can be regained without the super duper secure Yubikey fleet you have." Therefore it is as secure as that super expensive door lock when there is an open window right next to it. > Hopefully, that process involves a lot of red tape and not just an SMS-OTP or sending a blurry scan of my birth certificate to an e-notary several timezones away But that just does not happen. This would be super expensive and companies would rather limit their involvement with individual people to save on support cost. All I got from AWS was two phonecalls from a tired guy with obvious Indian accent.