> Nobody has a secure password on their phone, so your requirement fails. Well, you could if you want to. That you don't want to, is a failure on your part, no

> Nobody has a secure password on their phone, so your requirement fails. Well, you could if you want to. That you don't want to, is a failure on your part, not on "everyone"'s part, since most phones do offer you the feature of setting a sufficiently secure password. > However many people only have a phone, and no other computer (or at least not a computer they use often enough that we can trust the 2fa isn't expired). You don't need a second device in order to backup your codes. By leveraging "cryptographic splitting" you can divide a secret into N parts and share them with friends and family, and if you need to regain access, ask them each for their part back and then you can recover from there. Now I guess that's kind of advanced so most people won't/can't do that, but it is possible at least. You could try something like https://iancoleman.io/shamir/ https://iancoleman.io/shamir/ if you're curious about the process, I've done this myself for some things. Easier solution is to create a encrypted archive with your backups, and upload to various cloud services. As long as the encryption scheme is secure, you'll be safe. > The 2fa I've seen mostly has a SMS based fallback, and thus is no more secure than SMS. I'm using TOTP 2FA for 100% of every service I use and that offers it. I think only one requires SMS-based fallback, the rest are optional so obviously I'm not using that.