I feel that most forms of 2FA have too much friction for average users. SMS is bad, but better than nothing. I really can't imagine average users figuring out T

I feel that most forms of 2FA have too much friction for average users. SMS is bad, but better than nothing. I really can't imagine average users figuring out TOTP apps, U2F or other hardware tokens and dealing with backups and lost keys etc. Perhaps fingerprint based solutions based on WebAuthn will get more mainstream.