Some thoughts on app based 2FA, having recently switched phones and needing to redo all my codes: * I have to redo all my codes, and that’s annoying. I have ab

Some thoughts on app based 2FA, having recently switched phones and needing to redo all my codes: * I have to redo all my codes, and that’s annoying. I have about 15 and it took me almost an hour of logging in and out of all my accounts to switch the device. It’s very cumbersome and in most cases logs me out of my accounts on other devices. It’s frankly a huge pain. I understand the need for it but there needs to be a better way if we’re going to be 2FA everywhere. * Most sites/services don’t have an option for “change to new device” although some do. In most cases the way to change the device is to turn 2FA off, then turn it back on with the new device. It’s a terrible user experience (it’s not like it even tells you this is what you have to do, you just have to know it). If 2FA is so critical why do I have to disable it to switch auth devices? * The flow for using it on many sites still treats 2FA as like this geeky or techie thing, it would be very off putting if I wasn’t familiar with it. They’re not very reassuring about what it does or how it works (although some do try to help the user understand it). * Backup codes are janky and not always offered. Sometimes when they’re offered they’re explicitly provided when enabling 2FA, sometimes they’re a totally separate menu item and the site doesn’t explain why they’re important, some don’t have them at all, and most just dump a text file of weird letters and numbers in your download folder. No header or anything to say what they are when trying to find them later. Abysmal user experience. I had to resort to printing them out and scribbling with a pen what site they were for. Some sites though do better, and include header info and/or a print button. Just not many. * The Google Authenticator UI looks utilitarian and unintuitive. It’s nice that it’s so uncluttered, but again if I wasn’t already technical I would struggle with feeling comfortable with it. Why are the numbers blinking? What’s the countdown timer? Oh no the numbers are red now! Did I break something? Wait now they’re green again. What’s going on? I love 2FA and think it needs to be way more ubiquitous. But at least right now it’s still pretty shit.