[PON]

First, thanks for the Firefox tip. That's good to know. (Works perfectly).

Comments on the Yubikey:

I have had zero issues on any version of Linux (Mint, Ubuntu, and Debian mainly, multiple flavours 32 bit, 64 bit, different desktops) with Chrome / Chromium. I use Yubikeys mainly with Fastmail, Lastpass and Google accounts. Have also used Google Authenticator with Lastpass exclusively for the last year, as well as using it for years with other things that don't support Yubikeys (Synology login e.g).

For me a Yubikey is hands down more convenient than Google Authenticator. It's fast -- I have two plugged in to side by side laptops on my desk and a spare on my key ring. I don't have to find my phone. Open it. Enter a code. Find the app. Find the right authentication code. Wait for it to reset so that I have time to enter it before it changes.

I don't have to worry if my phone is charged or if i lose the device and I have backup keys. I've somehow not got around to having an additional Google Authenticator set up on another device. I tried it once, ran into some problem and never got back to it. Wasn't even sure I could do it.

Even if I didn't have a Yubikey I can still get to my email in two ways: password reset via SMS and, if I didn't have my phone, via a login that doesn't require 2FA. I can do that in two ways: masteruser a/c (which I don't use w 2FA and rarely use) and also via a backup account with another provider (first MX record points to it) which I actually use for preprocessing mail and which maintains a chrono file for me. I use this if Fastmail is unavailable or if I need to check for rejected mail. In 16 years I've needed it twice when Fastmail was unavailable and once to understand why some non-received mail was undeliverable (sender had no reverse DNS).

A time delay before SMS kicks in as a fallback authentication approach seems to me a potential double-edged sword when you need access to mail NOW and don't have a Yubikey -- your keys are missing or whatever.