TOTP apps, and WebAuthn recommended devices?

[Greg Troxel <gdt%lexort.com@localhost>]

2FA is increasingly required, which is fine, but I wonder about
strategies for coping as a NetBSD user.

One thing is TOTP.  There are Android apps from f-droid (which suits me
but not everyone), and there is vaultwarden which should allow bitwarden
to do TOTP.  I wonder if there are good TOTP programs in pkgsrc and what
people recommend.


The other thing is WebAuthn which is apparently the new U2F.  I'd like
to get some security keys for this, probably 3 (carry, non-carried
backup, offsite cold storage) for long-term availability.  What devices
are recommended, meeting:

  allow enrolling in a bunch of different sites (dozenish, not 1000s)

  work on NetBSD with firefox (netbsd 9 amd64 at the moment)

  work on Android with free software only, preferably with NFC

  work on GNU/Linux and macOS

  available from a vendor that I've heard of

I am not super concerned about state-level supply chain attacks, but
since I know some of you are Wicked Paranoid as we say in Boston, bonus
points if I can walk into Walmart/Target and pay cash :-)

It looks like the Yubikey 5 might fit the bill.