A second way to address it, with LastPass in particular, you can sync up to four Yubikeys – so one for your keychain, one for your travel bag, etc. That’s my system. The third, again with LastPass, is that there are smartphone apps for all the major platforms that give you access to your passwords so that you can pull them up on the phone app and manually enter them when you hit a website, so you’re locked out of convenience, but not totally out of your work.

Third, there are other two-factor systems that might be more convenient for you. For example, Google and some banks offer two-factor authentication by way of a text message code sent to your phone. In order to access Gmail or Bank of America, you need your ID, password, and your phone. Chances are far less likely you would forget your phone than your Yubikey on a trip.

But ultimately two-factor authentication means keeping track of a physical object and having it with you when you want to gain access to a site. It’s a combination of something you know and something you have, be it a Yubikey or a phone. I agree that there is an additional burden of tracking a physical object, but security is gained by sacrificing some convenience. If a personal anecdote helps, I’ve used Yubikeys with LastPass since July of 2010 and not been locked-out yet.

m2