> Github is an example, you can always trigger the fallback SMS 2fa code. You can setup OTP (no SMS) and either keep it as a backup, or destroy the key. I don'

> Github is an example, you can always trigger the fallback SMS 2fa code. You can setup OTP (no SMS) and either keep it as a backup, or destroy the key. I don't have SMS on Github. Admittedly, it won't solve issues with all services. From the service perspective, dealing with users who lost their security key (or don't have a backup one) is too painful wrt to forcing you to have an alternative.