On: Using Yubikeys Everywhere

[raaaaraaaa1]

Authenticator app gives me just 6 digits, it does not seem to be safe. I wonder how much resources attacker would need to compromise google account by brute force method.

(of course he would need to know my google account password)

[jon-wood → raaaaraaaa1]

Its near impossible. Not only would they need to brute force it, but they'd need to brute force it in the 30 second window available before the code rotates again.