The questions you are asking are the wrong questions. Which is typical of people unfamiliar. Deploying 2FA is easy. There are recipes. Anyone can do it. The h

The questions you are asking are the wrong questions. Which is typical of people unfamiliar. Deploying 2FA is easy. There are recipes. Anyone can do it. The hard part is account recovery. Expected to spend 85% or more of your time on that aspect. You may not even arrive at a solution you are happy with, just one that is least bad. >I am ideating on a 2FA method using cryptography where the user will not need internet on his phone. Done over and over again. You are doing nothing useful. Account recovery is where some magic is worth doing.