YearOfTheCommieDesktop [they/them]

mostly recovery codes. I have multiple yubikeys but that’s mostly for work

yeah, when sites support it, that’s definitely the best option, but many sites only barely do totp lol so I have to have to put the totp codes somewhere, and the yubikey handles it in a pretty nifty way

as far as I know upstream lemmy doesn’t want it and is waiting on pictrs proxying support. If I’m wrong though our code is public, I’m sure a dev would be happy to put together a PR,

Hexbear.net stays winning, external embeds are domain whitelist-only until pictrs adds proxying support, and blurred by default.

Good PSA tho, I’d honestly encourage other instances to do the same but it requires dev effort that I know not everyone has, and upstream isn’t quite as paranoid about this stuff.

For reference:

Not on iOS but I like my yubikeys. Depending on your requirements (if you have less than 32 TOTP accounts per yubikey), they can handle your TOTP directly instead of just using them to unlock Bitwarden.

For security I don’t like to keep my TOTP keys in my password manager, even if it is strongly protected. With a yubikey I can ensure that both access to the key AND a physical touch is necessary to generate any codes. So even if I leave it plugged in on a remotely compromised PC I’m mostly protected, because a touch is required.