Using Yubikeys Everywhere
You can have a security key on Google without a phone number, but you have to enroll with a phone number and then remove it. Google won't allow you to remove the phone number unless you have some other backup 2FA method available.<p>The best Google (actually: everywhere) 2FA "stack" in Q1 2017 is:<p>1. Hardware U2F<p>2. Software TOTP (Authenticator app on your phone)<p>3. Physically secured backup codes<p>4. Disabled SMS<p>My experience with the Y4 hardware and, particularly, software has not been great. I'm using the Y4 for SSH access (through ssh-compat mode on gpg-agent) and it's mostly OK, but if I try to use PIV mode on the same token I run into all sorts of problems. I'm bullish on U2F, but bearish on Unix token applications.