tnbp

Your comment is incompatible with mine, so one of us must be incorrect; I will leave it at that.

This! Your bank should never get a say in what you run on your phone or even if you have a phone. Do not take any such bullshit.

I can show my government-issued ID to any third party without the government knowing about whom I've shown this ID to. The third party needs to trust the government and the authenticity of the ID.

The problem is that my ID contains too much information; I would prefer a document (i.e. digital certificate) that only certifies my age, not my name, address etc.

That sounds nightmarish. I don't want the verifier to know what porn sites I visit. Someone else proposed the following system to me: a third party authority issues a certificate which I can then use to prove I'm 18. The CA cannot see where I use the certificate, though.

  Some more clever sites asked for my birth year… forcing me to do the arduous work of taking the current year and subtracting 14.

But why? You could have just picked a year that worked, and sticked with it. Obviously, there's no way of telling which year works, but you could have bruteforced that just once.

We have no reason to believe you. However, there is one party who really benefits from people considering all encryption weak and all cryptography broken: the NSA.

You should not require users to change their passwords periodically, as this will piss them off and make them use many weak passwords rather than one strong password. Only require a password change when there is reason to believe their old password has been compromised.

You can technically do this with TOTP if you save the secret instead of simply enrolling the account. You're not supposed to do that, though.

Both are true, #2 is huge. I would like to add: 3. Self-checkout displaces workers to the benefit of stores and the detriment of society at large.

Surely, this computer must have come with a non-BT keyboard and/or mouse, though?

  Even if I do have keys, they are safe in my pocket, not sticking out the side of a fragile USB port.

It's difficult, though not impossible, to break your USB port with a Yubikey due to its shape. It's not a regular USB plug and will come out quite easily.

  but how about when I'm using a mobile and my laptop is in my bag, or at home?

USB-C and NFC variants are quite common.

  And OK, lets say I solve all that. How do I add a second key?

The same way you add the first--most of the time, you have to scan a QR code. You can scan it more than once.

  The beauty of SMS for 2FA is that my phone number sticks with me. If my phone is lost or stolen, a new sim card is sent to my home and I have access to all my 2FA authenticaitons.

I'm not giving you my phone number, and mobile providers are known to send replacement SIM cards to random strangers if they ask nicely.

where can I read your paper

But it's a key though. It goes on the keychain. Unless you don't carry around keys either, in which case yes, that would be very inconvenient indeed.

Also, your Yubikey is probably less likely to be stolen or break, but I figure it's much easier to lose it, which is why you might want to have two, just in case. And that's where it gets really inconvenient.