I think your first instinct is correct, here. While they probably would feel safer if everybody was using Google Auth, Authy, or a physical device, it gets arou

I think your first instinct is correct, here. While they probably would feel safer if everybody was using Google Auth, Authy, or a physical device, it gets around people having to explicitly copy tokens around which, IIRC has been abused a fair bit in order to steal credentials.