<story><title>Twitter lets you use 2FA without a phone number</title><url>https://twitter.com/TwitterSupport/status/1197630682631221248</url></story><parent_chain><item><author>roca</author><text>Unfortunately there are two big problems:&lt;p&gt;-- You can&amp;#x27;t provision more than one security key. I want to provision a backup key.&lt;p&gt;-- You must have TOTP or text-message 2FA enabled in order to use a security key. But the very reason I want to use a security key is because I don&amp;#x27;t want to trust my phone!</text></item></parent_chain><comment><author>oxplot</author><text>What is it with this bullshit practice of requiring TOTP&amp;#x2F;SMS setup first before using security keys! I&amp;#x27;ve seen this all over the place, seemingly copied from all the existing ones. Basically they&amp;#x27;re saying, you must have a less secure 2FA before using a more secure one. Even github does this circus show but at least it lets you register two keys. So what I do is to setup TOTP, add two keys and then remove the TOTP on my phone.&lt;p&gt;As for limitation of one key, I use my Yubikeys with TOTP as well, so for services that don&amp;#x27;t support more than one security key, I store the same TOTP private key on both my security keys and get around it.</text></comment>
<story><title>Twitter lets you use 2FA without a phone number</title><url>https://twitter.com/TwitterSupport/status/1197630682631221248</url></story><parent_chain><item><author>roca</author><text>Unfortunately there are two big problems:&lt;p&gt;-- You can&amp;#x27;t provision more than one security key. I want to provision a backup key.&lt;p&gt;-- You must have TOTP or text-message 2FA enabled in order to use a security key. But the very reason I want to use a security key is because I don&amp;#x27;t want to trust my phone!</text></item></parent_chain><comment><author>aftbit</author><text>You can do TOTP authentication on any device that you do trust. It&amp;#x27;s just an HMAC of a timer. I use oauthtool: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.nongnu.org&amp;#x2F;oath-toolkit&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.nongnu.org&amp;#x2F;oath-toolkit&amp;#x2F;&lt;/a&gt;</text></comment>