U2F key is praised for its security features. But I am afraid of using something so secure that when it is damaged I couldn't access my own accounts. So I searched what is recovery scenario and for example Amazon describes it as following:

if you can't sign in with your MFA device, you can sign in by verifying your identity using the email and phone that are registered with your account.

Ok, so I could get my data without U2F, but then... the potential intruder would need no U2F too. Avoiding email/phone path was the whole point behind U2F device, right?

My question is as follows -- do I miss something or the case of damaged (true or false) U2F key is actually a weak spot? I mean either recovery is easy for user (and intruder) or it is hard/impossible for user (and intruder)? Are those only two choices, or there is some middle ground, where it is easy for the user but hard for intruder?


In most cases, you can configure OATH-TOTP access as a backup. Sometimes, you can also register more than only one U2F key.

Not the answer you're looking for? Browse other questions tagged or ask your own question.