@dreid That sounds sensible. The YubiKey TOTP code appears to support HMAC-SHA-256 but Google Authenticator and GNU OATH Toolkit only do HMAC-SHA-1.