If you don't understand the different types of 2FA available, I don't think you're really in a position to be making blanket statements about if people should b

If you don't understand the different types of 2FA available, I don't think you're really in a position to be making blanket statements about if people should be using it or not. "The application" is an open standard called TOTP, which doesn't require any specific application. I just set up 2FA for my personal GitHub account using a TOTP app on my Pebble watch. The actual crypto for the 2FA is done locally on the watch, no other device can spoof it, and GitHub get exactly zero feedback or information from this - other than the 2FA code that I type, of course. There's other ways to do 2FA - U2F is an upcoming standard and people have been using dongle-generated codes from RSA for years. Before making pronouncements that go against current best practices for end users, you really need to get a much better understanding of what you're talking about. Saying nonsense in a confidence voice is enough to convince people that your terrible advice is worth following, and could result in them having worse information security as a result.