I'm so fucking sick of Google and other sites ratcheting up ""security"" and bullshit steps to """"""""""protect"""""""" me when they don't give half a rat's ass about any individual welfare or security. like they literally don't give a shit about any of us but this stupid fucking forced 2FA crap and mobile-tied-to-all-account-actions-on-desktop Google got aggressive on is pissing me off beyond anything else. this shit is forced on us only to remove themselves from any claims of liability.
I use a password manager for years (keepassdx & keepassxc) to generate absurdly long random passwords and change them at least yearly. no shady downloads on my PC, no pirated stuffs of any kind, I'm computer savvy in general and run a tight ship. recently trying to clean up (log out) some old mobile sessions on my Google account, and change my main account password, things I've done quickly and without hassle in the past. suddenly being asked for password AND forced to tap the stupid fucking number sent to my Android phone, which of course I don't receive because it's sending to some stagnant Android session that was overwritten by my various Android and GrapheneOS installs (tinkerer).
completely stonewalled on my own account now. can't change password any more because the shitty little kindergarten secret passcode doesn't send to my current accessible Android install, can't log out old devices to keep it from being sent to those. tangential note, last year the rent payment portal for my shithole apartment added forced 2FA to all accounts too, never had it before and shit was just fine, but now an extra step and waste of my fucking time just to pay the do-nothing landleech who lives in a different fucking state.
so fucking pissed I could break someone's face rn. fuck everything. fuck capitalist-infected software. fuck techbros. fuck Google. fuck AI. fuck Flock. so tired of this endless fucking bullshit that keeps getting worse. thanks for hearing my TED talk.
They're doing their best to make hardware keys suck too
I'm literally a professional and ""passkeys"" (FIDO2) still fuck me over every 2 weeks or so despite me intentionally never using them
want to use your yubikey in U2F mode to sign into the google account you configured it as a 2nd factor for on a new machine? TOO BAD, microsoft windows has decided you must use FIDO2, with a PIN, and even then it's just going to give you a cryptic error about "hardware key not recognized". (and yes I know, my fault for using windows, but every so often I have to, it's not my daily driver)
Same problem on Android, the FIDO2 rollout utterly broke U2F, and FIDO2 is an overcomplicated turd that isn't a direct replacement for U2F and has limited support from sites/services...
And that's on top of the issues OP is experiencing, which is MFA rollouts being done without user consent, often in invasive and insidious ways (vendor lock in is everywhere), or in ways that actually reduce security rather than raise it (looking at paypal here, among other sites)
All this to say, yubikeys are pretty good but they definitely won't stop you from pulling your hair out about 2FA