When is too much MFA a security risk, SMS, Email, Authenticators, Pass Keys, FIDO2/hardware keys, blows my mind!!!
Hi all, long post but looking for honest experiences and opinions.
Quick background: I started with SMS 2FA (yes, I know it is weak), moved to free authenticator apps (Microsoft and Google) for my primary email and finance apps, and recently added a YubiKey (PIN + touch).
After many sketchy 2FA requests and rouge main email login attempts, I opted to delete my primary emails and split my accounts into multiple email aliases, hoping this would tighten things up going forwards.
My question: Am I making things weaker by keeping too many backup routes?
I am thinking of simplifying to one strong hardware key and one backup key (roughly $80 main + $30 backup) with offline recovery keys per account.
Should I remove lower-security recovery options like SMS, email recovery, 2FA and pass keys alltogehter or is that too brittle if I lose access?
What I care about: Phone theft, phishing resistance, recovery if I lose a device, and avoiding the attack surface from multiple recovery paths. I plan to register at least two FIDO2 keys for critical accounts and keep recovery codes offline, but I am unsure whether to keep pass keys and an authenticator app as a fallback??????
Do you all have offline copies of your Google, Microsoft, and Apple account recovery keys, not to mention all the other key accounts that have offline backup account recovery keys?
Have you ever used them, and have they saved your account?
I would love to hear your experiences: Has a hardware key ever stopped a phishing attempt for you, or has MFA been bypassed despite having keys or authenticators?
If you lost / damaged a hardware key, how painful was recovery and what did you change afterward?
What hardware keys do you use, have you used biometric hardware keys, what would you recommend?
Do you think a primary hardware key plus one backup is enough, or do you keep additional fallbacks, and why?
Real, specific stories are most useful. Thanks in advance!