Thanks for the in-depth explanation. My reaction has maybe been a bit knee-jerk, it's not like this is a major annoyance. The attack scenario is quite convolute

Thanks for the in-depth explanation. My reaction has maybe been a bit knee-jerk, it's not like this is a major annoyance. The attack scenario is quite convoluted with needing both access to the account and a phishing attack for the one-time key, but I suppose it is plausible. At the same time this does open users to new attack vectors though, especially with SMS.