I agree, mostly because of the lack of self-managed MFA mobility. The ideal situation is for a site using 2FA to allow me to choose the 2FA application: Google

I agree, mostly because of the lack of self-managed MFA mobility. The ideal situation is for a site using 2FA to allow me to choose the 2FA application: Google Authenticator, Authy, OneAuth(I think), etc. Tools like Okta Verify, RSA, Symantec, or SMS based 2FA make the phone a true SPOF. You can't have backup codes, you can't migrate installations. In other words, I hate forcing my phone to be an irreplaceable hard token lest I drop it in the river and have to do a bunch of resets.