This isn’t strictly a privacy question as a security one, so I’m asking this in the context of individuals, not organizations.
I currently use OTP 2FA everywhere I can, though some services I use support hardware security keys like the Yubikey. Getting a hardware key may be slightly more convenient since I wouldn’t need to type anything in but could just press a button, but there’s added risk with losing the key (I can easily backup OTP configs).
Do any of you use hardware security keys? If so, do you have a good argument in favor or against specific keys? (e.g. Yubikey, Nitrokey, etc)
I’m not an expert but the way I see it is this: if you’re tech-savvy and use common sense, they’re not necessary, as a 2FA app with TOTP along with random, strong passwords should be enough. I still use both for most things, only securing more sensitive stuff with a physical key.
However, having one definitely can’t hurt, and if you’re passionate about cybersec, it’d be kinda strange if you didn’t have one.