U2F key is praised for its security features. But I am afraid of using something so secure that when it is damaged I couldn't access my own accounts. So I searched what is recovery scenario and for example Amazon describes it as following:

if you can't sign in with your MFA device, you can sign in by verifying your identity using the email and phone that are registered with your account.

Ok, so I could get my data without U2F, but then... the potential intruder would need no U2F too. Avoiding email/phone path was the whole point behind U2F device, right?

My question is as follows -- do I miss something or the case of damaged (true or false) U2F key is actually a weak spot? I mean either recovery is easy for user (and intruder) or it is hard/impossible for user (and intruder)? Are those only two choices, or there is some middle ground, where it is easy for the user but hard for intruder?


1 Answer 1


In most cases, you can configure OATH-TOTP access as a backup. Sometimes, you can also register more than only one U2F key.

Not the answer you're looking for? Browse other questions tagged .