The failure modes of 2FA and what happens when a token is lost or breaks are definitely one of the pain points. I'm not a fan of the "back up recovery token" a

The failure modes of 2FA and what happens when a token is lost or breaks are definitely one of the pain points. I'm not a fan of the "back up recovery token" approach, as if you only need the backups once every couple of years, a lot of people (myself included) are likely to misplace, forget where the tokens were. My current approach is TOTP with sync via iCloud, so the tokens are available on each of my mobile devices, so unless I lose all of them I should be ok. Of course that provides a weak point (my iCloud account) but there's always a tradeoff somewhere.