I have set up my Apple Account to require two Yubikeys (thanks Apple; one for everyday/traveling and one secure/at relative, very good principle so you don't loose your account if one is lost). Security Flaw: I can change my email address on my iPhone SE 2022 (iOS 26.6.1), with only unlock code even though Yubikey is required for login. Meaning: If someone has my iPhone and knows my unlock code (by seeing it/security camming it?), they can change my account e-mail address and I'm superhacked. Moreover: I do hope the setting iCloud.com that enables web login requires Yubikey. I hope this lax security requirement changes. Readable: Me: I use USB-A Yubikeys so I can get to my Password Manager Bitwarden EU on almost any computer in the world if my phone is lost/stolen. That password is comprised of four long words personal to me strung together and Yubikey(s) are required. All other accounts have random unique passwords made with password manager. Swedish Yubico Yubikey for logging in to Password Manager with email/password data stored in Europe, not US, which unlocks random passworded Apple Account to start new iPhone, bank login PIN-code device to log in to Swedbank App, which unlocks swedish digital authentication service Mobilt BankID, which I need to get to mobile operator Telia App, where I can get an eSIM to my replacement iPhone without physical SIM card to get back my ordinary number back up, and never stop moving. Telia also has the best quality of service in Sweden. Quality is often included when paying more than the cheapest. Yubikey 5 NFC | Yubikey 5C NFC About password strength: correct horse battery staple (don't use this as password). Use strong+long(+yubikey) for password manager, which holds passwords for other accounts. They get to your email and they can get to a lot of accounts using the 'Forgot Password' function, so secure that well (i.e. password different from other sites and/or Yubikeys). I use random unique 21 character passwords with A-Z, a-z, 0-9 and !@#$%^&*. Separate random unique passwords at every site makes you waaay less hackable. They hack one site and gets your email+password there, and you have the same to your email account, they can get to your x accounts then (=superhacked). Bitwarden.com: It's waaay to easy to mistakenly create a US account if you're a European citizen. (!!! Look for EU vault in small at bottom of the page when creating an account and when logging into vault) Also lacking migration option US->EU I still believe [2026] (You have to export passwords from US account, import them into EU account and then delete the US account) (I hope your data/passwords were promptly removed from US then, removed from backups, etc). TouchID, my favorite everyday physical button, I always know where it is and it's always 100% successful attempts, and I like that. [Show Negative]