Become unbannable from your email

> It's maddening that they haven't come up with a reasonable way to allow a purchaser to register multiple Yubikeys to enable freely restoring backups between them.

It is possible, using a cryptocurrency hardware wallet allowing to install tiny apps on the hardware wallets. These wallets are meant to initialized by a "seed" and there's a protocol to easily write down that seed (a list of words, all coming from a dictionary of 2048 words and the list of words contains a checksum in [part of] the last word).

Now from that seed, cryptocurrencies hardware wallet can derive any secret. And it's possible to derive a secret that's used like Yubikey.

So as long as you have your "seed" backed up somewhere, you can duplicate your 2FA key.

I did test the old U2F version, pre FIDO2/webauthn, using early Ledger Nano hardware wallets and it worked.

I think there's now a more recent version available but haven't checked that. A Ledger Nano S Plus, from their website, costs 70 EUR / 80 USD. I'd say it's not too pricey to try it and see if it could suit you. Check their available apps first and see if there's one that can simulate a Yubikey (or a similar 2FA security key).

I know HN loves to hate on cryptocurrencies but I'd say that at least the crypo-bros got the "you cannot trust your computer" part right. The attack surface of a cryptocurrency hardware wallet is not only minimal: it's minimal on purpose, built on the premises that computers were not devices to be trusted. They're literally built with the idea that they can be used on a compromised computer and you should still be safe, so there's that.

This was actually way more actionable than I was expecting

I’ve considered running an email server on my personal domain for some time, but the effort of changing my email hasn’t felt worth it to me, given how many services I’ve signed up for with my current email (a Gmail address). Is anyone aware of any strategies to make this easier? It’d be nice if I could set up forwarding so services would automatically use my new email, but I’m not sure if something like that exists.

Many email service providers give you the option to fetch all emails from a different service not just as a one-time thing, but ongoing. I'm not sure how that could be set up when running your own email server, but I bet there's a way. Even if there isn't, you can set up automatic forwarding in Gmail.

There's a chance forwarding is better than fetching. I once had a Gmail account stolen, and account recovery was locked for some reason, but email forwarding had been set up and I was still able to get all emails the address received.

In case it's relevant, I happen to use Fastmail now and their "mail fetch" feature involves imap.

There’s an attack where you get signed up for mass marketing emails and your mailbox gets flooded with emails from mostly legitimate companies.

Say someone gets into an account you use to purchase stuff (Amazon, etc), but they don’t have access to your email account. They sign you up for this mail flood, then start buying stuff with your Amazon account, and legitimate notifications of purchases are lost in the noise with many thousands of emails from everything from Apple to Chuck’s Boat Rentals.

Using a unique and unguessable email lowers the chances of a more important account being affected (obviously at some point we’re splitting hairs).