> I DO have to remember some passcodes which I otherwise never use but that's not too hard.
Right, but you're giving up a lot of security to do this, since it implies with these rare passcodes someone else could also bootstrap your logins.
With HW tokens, you don't have to worry about recovery passcodes being leaked/hacked (the recommended procedure today is to print out the recovery codes and destroy digital copies).
This idea of printing out recovery codes seems so deeply out of touch with basically everyone leading a modern digital life that I can't believe serious security experts actually recommend it with a straight face.
No one has a printer anymore, and I'm sure as hell not including a trip to a local printshop as a part of signing up to 2FA for some random site (yes, even Gmail).
Of course to do that I need to go to a public library where I have no idea if they keep copies, and where someone might mistakenly take them from the printer, which is very far away from the computer you must use to print.
Don't explicitly label the codes with their corresponding accounts on the print out, just print the actual codes. Write the corresponding accounts in later. Recovery codes don't do much unless you know where to use them.
grab a pen and something to write on (worst case: buy a pen and write on receipt paper). write down single recovery code to cloud storage thingy. store other recovery codes there.
You could just store them in a separate password manager like BitWarden? Or even encrypted in a separate Dropbox account?
Ultimately if you want to be able to recover your identity from anywhere in the world with absolutely nothing on you except cash (to buy a new device and service), you have to store this data somewhere. And you wouldn’t store this data in the same place that you’re trying to recover because that’s not very useful.
Is it without risk? No, but there is no risk-less way to be able to recover a piece of data once you lose all your possessions somewhere random in the world because the only thing you have left that you can still use is what you know.
You can lose hardware tokens in the same way you lose a phone? Then you’re just as screwed?
This isn’t a hardware token versus passkey problem. It’s a problem period if you store a piece of vital data on a physical device. You can lose it, period.
The only way to restore that piece of vital data is to have a backup. To have it restorable from any connected part of the world with complete loss of your personal artifacts, either you need an very trusted intermediary that you can contact or you need to store it somewhere Internet-accessible, preferably encrypted with a key that you can remember.
Right, but you're giving up a lot of security to do this, since it implies with these rare passcodes someone else could also bootstrap your logins.
With HW tokens, you don't have to worry about recovery passcodes being leaked/hacked (the recommended procedure today is to print out the recovery codes and destroy digital copies).