U2F key is praised for its security features. But I am afraid of using something so secure that when it is damaged I couldn't access my own accounts. So I searched what is recovery scenario and for example Amazon describes it as following:
if you can't sign in with your MFA device, you can sign in by verifying your identity using the email and phone that are registered with your account.
Ok, so I could get my data without U2F, but then... the potential intruder would need no U2F too. Avoiding email/phone path was the whole point behind U2F device, right?
My question is as follows -- do I miss something or the case of damaged (true or false) U2F key is actually a weak spot? I mean either recovery is easy for user (and intruder) or it is hard/impossible for user (and intruder)? Are those only two choices, or there is some middle ground, where it is easy for the user but hard for intruder?
