Paying for LastPass Premium allowed me to use that. Using a security key–Yubikey being one brand, “U2F” an older standard, “WebAuthn” a newer and broader standard–allows two-step verification independent of both your wireless carrier and your current phone. Using an app like Google Authenticator takes your wireless carrier’s security out of the equation but requires regenerating these codes each time you reset or switch phones. The easy but brittle way to get a two-step code is to have a service text one to you, which works great unless somebody hijacks your phone number with a SIM swap. Two-step verification, if any reminder is needed, secures your accounts by confirming any unusual login with a one-time code. Instead of that minimal outlay, I’m irked by LastPass’s implementation of the feature I had in mind when typing in credit-card digits: support for Yubikey U2F security keys as a form of two-step verification.

And I’m starting to regret that expense even though $2 a month should amount to a rounding error. I finally signed up for LastPass Premium after years of using the free version of that password-management service.

Lastpass authenticator yubikey