[gtsteve]

I have hidden recovery information in a few places on the internet - someone stumbling across it would not know what they are looking at, or what it's for. For example, you can hide the TOTP secret for an authenticator app, but it's useless unless you know what account and service it's for, and the associated master password.

[sesky]

So to mitigate lockout risk, you keep multiple Yubikeys, store recovery codes in multiple physical locations including presumably a fire-proof safe bolted into your home (at your expense), and use obscurity to store the TOTP secret on random places in the internet, presumably relying to external services or a self-hosted solution, which are themselves dependent on regular credit card payments going through.

Okay, I grant that you've reasonably mitigated the lockout risk. But I don't want to do any of this, and is it really reasonable to expect the everyday person to understand or implement all this? What happens in practice is that many users will not realize anything is wrong until they get locked out with no recourse.

This makes it hard for me to recommend Bitwarden to my friends who use typical insecure practices like password reuse or post-it notes.

[alt227]

> But I don't want to do any of this

Security has either been easy and weak, or difficult and strong. It will never change and so you will always have the option of weak security if you dont want to jump through the hoops for the peace of mind.

> my friends who use typical insecure practices like password reuse or post-it notes

IMO people who do those things will never change. Its like the environment, everybody knows what they should be doing but no-one cares enough to do it.

[rsync]

A better way to mitigate lockout risk is to use a 2FA mule:

https://kozubik.com/items/2famule/

[stronglikedan]

sure, but we shouldn't have to do that if we don't want to. it shouldn't be "mandatory"