@lanodan @sjw I will add a couple more interesting points about security on fedi, or rather pleroma:
1.admins pleroma can increase the length of the code on the two factor, on sites that have two factor, the code is usually 6 digits as pleroma can easily increase to this limit I do not know but when I was admins, I increased to 8 digits, but the more the number of digits generated by the more resources will be used

2.Who knows about yubikey support in pleroma?