I've had an idea for a new blog post :akko_thonk:

My approach to safely handling hardware MFA tokens so you don't royally fuck yourself when (not if!) you end up losing them. I'll also address handling the aftermath of losing them: considering those hardware tokens completely compromised, which requires removing them from every site you added them to.