Yeah, you're right. The backup codes are a big pain, and kill the security of the account. (Like many others, I don't print those out... they're just in my pa

Yeah, you're right. The backup codes are a big pain, and kill the security of the account. (Like many others, I don't print those out... they're just in my password manager.) OTP backup is no less secure than that, and is a strong usability improvement. Things would be way better if people just implemented WebAuthn, though. It's more secure than OTPs, and it's so transparent and easy to use that people think it's less secure. Passwords and OTPs should go away, and it's only a few lines of Javascript to make them go away. Sigh!