[lfowles]

The point is that without it, information just as freely flows to someone with your password across the world. Getting USB sticks like this is a win for me, I hate using my phone for 2FA as well, but something I can just toss on my key ring? Hardly a burden.

[dheera]

What if the thing you're trying to access from doesn't have a USB port? Like, an intelligent table surface, a digital wall, a smart goggle device, or even an tablet that only has a micro-USB port?

Information flow protocols and hardware should be abstracted and separated in the same way that we generally separate church and state in most modern nations. Otherwise, the innovation of either is going to be pulled behind by the other.

[mongol]

Likely the next step for those will be NFC communication. Yubikey NEO has this for example, and can be used with Android phones. Note that U2F uses challenge - response protocol so sniffing the radio waves will not reveal the secret.

[lfowles]

Depends on what you're trying to auth with. For example, I was just reading about activating 2FA on my Google account and the backup options were:

* SMS Verification code

* Manually generated list of backup verification codes

[dheera]

A lot of services seem to love using SMS-based 2FA. Thing is, I've already made a personal decision to ditch SMS as antiquated technology (along with the telegram), in favor of e-mail, WeChat, WhatsApp, Facebook and other communication alternatives.

Since some apps apparently still want to cling to old technology, I have one SMS-enabled phone number -- a Google Voice number which forwards to my e-mail address. I don't need to carry my phone around to get my SMS messages. But then again, it's not really 2FA anyway, it's just an annoyance; effectively 2 passwords (one to login to the app, one to login to my e-mail to check my SMS messages).

[tokenizerrr]

Then you fall back to using TOTP (Google Authenticator), or SMS codes, or printed backup verification codes.