> It's also taking away the possibilities of the user entering numbers incorrectly (TOTP for example). Awfully weak. > Some countries have started introducing

> It's also taking away the possibilities of the user entering numbers incorrectly (TOTP for example). Awfully weak. > Some countries have started introducing rules for certain industries where they're not allowed to switch between apps on a mobile phone. For example when trying to find their Authenticator app or checking their SMS/email for a TOTP. Which countries are these? > And finally, it is phishing resistant. You can phish for a users TOTP. You can't with a data connection the mobile device itself has to make over cellular data to the mobile network operator directly. What if the user is using a VPN?