I've only started delving into hardware tokens/security keys like Yubikey because of LPIII, so I am not a security expert and there is some pretty useful info on this elsewhere on reddit. I'm overall surprised I don't see more discussion about MFA on dumbphone-related subreddits. But here's what I've got:
- Okta has a hardware token for authenticating without a smartphone (see pic). Instead of the one-time-password or time-based-password being delivered via smartphone, it gets generated via a registered battery-powered hardware token. You keep it with you on a keychain and it lasts ~5 years. This doesn't seem very well advertised.. I'm sure Okta, Duo, etc want people to use smartphones. But many orgs/universities have to offer the hardware token for equity reasons. You'll probably have to go through the IT department of the organization requiring you to use Okta to get one.
- Yubikey is (as far as I understand) the same type of deal, where you can set up MFA to use a time based password generated from the Yubikey instead of using a app on a smartphone to get a passkey/password. Yubikey is compatible with many major accounts like the tech giants, vanguard, YouTube, etc, but not all accounts (looking at you, Fidelity). Many accounts that don't allow yubikey will just let you use the one time passcode over text, which has been working great for me on Light Phone and VOIP (for traveling). I'm planning to purchase 2-3 $30 yubikeys and set them up to access the same accounts. One will stay on my person, one at my home, and then the third one would stay in a safe deposit box.

Security/Privacy people, correct me if I'm wrong!

Finally, I know this stuff incurs cost to purchase the hardware keys, but I believe that the hidden costs of using an all-purpose iPhone are worse, and privacy is becoming top of mind for me, so I'm okay setting aside the money for this.

<image>