> If I break my house key I can know exactly where the broken parts are but I still can't unlock my front door. This actually isn't true (it's exactly why digi

> If I break my house key I can know exactly where the broken parts are but I still can't unlock my front door. This actually isn't true (it's exactly why digital 2FA is different!) If you break a physical key (already much less likely) you can still read the bitting (~ password) off of it. Bring the broken pieces to a competent locksmith and they can originate a new key for you. 2FA doesn't let you do this (intentionally, it's not a bad thing but it does mean recovery is harder). > recovery keys any decent website makes you save or print out are for Right, and almost all of the services that I still have on TOTP 2FA are not decently implemented... and do not have the concept of recovery keys (they are actually a somewhat recent inclusion in the setup process)! Sites that are modern enough to have made recovery codes usually also support HW tokens which I would've used instead.