This doesn’t solve the original problem though, this is just a potential mitigation strategy for when/if it goes bad (e.g. the cell number is hijacked). It’s p

This doesn’t solve the original problem though, this is just a potential mitigation strategy for when/if it goes bad (e.g. the cell number is hijacked). It’s personally annoying to me how many 2 factor equipped sites force the use of SMS as the second factor. I imagine the conversation with the PO/PM for the feature must frequently include discussion of fears that allowing customers to opt out of SMS 2FA and use their own code generation tools is risky; you are relying on customer not screwing up to keep them as a paying customer. They lose their personal Authenticator and recovery keys, it can be really awkward to fix. SMS could be argued to be superficially more attractive in this regard, given a cell number can be reissued unlike the permanently lost authenticator device/app. Of course the security of SMS 2FA is terrible etc, but I can understand some of the fear of the alternatives if you need to keep customers happy and able to actually use your service.