Yep -- you must save the backup codes off line, off-device for any hope of recovery from loss or damage of that device. This is the weakness of the scheme. It

Yep -- you must save the backup codes off line, off-device for any hope of recovery from loss or damage of that device. This is the weakness of the scheme. It relies on people doing something that most people are not good at doing. Thus there will probably be a way for the user to recover without the codes (sending in photo ID or whatever) and that will be the point of attack for anyone trying to maliciously take over the account.