Google removed my Yubikeys from a Google account 'just to be safe'
Google&#x27;s implementation does not seem to be doing much good anyway. To be fair, it is not just Google -- most companies feel the same pressure of having to implement MFA but then also make it convenient for clueless users to recover their access.<p>The right way to implement hardware keys is to allow registering multiple of them (so that you can put at least one or two off-site -- in a secure storage) and then not let you recover the access under any circumstances without showing you still own at least one of those keys.<p>If you can recover access without the keys then what is the point of keys in the first place?