SMS MFA is ridiculous and should not be a thing. Phones are very unreliable (between trying to daily drive a PinePhone in the past for a while, and AT&T's devic

SMS MFA is ridiculous and should not be a thing. Phones are very unreliable (between trying to daily drive a PinePhone in the past for a while, and AT&T's device whitelist after the 3G shutdown, I've been through a lot of crap). TOTP seems fine to me. Can run it on various devices without a SIM, including just using a password manager like keepassxc on your computer that lets you copy paste the code. Sadly this all gets dumbed down and obscured so most people don't realize what TOTP is or that standard things are being used. We get told to download Google Authenticator or Microsoft Authenticator and keep it on our personal phone against our wishes forever. Hating MFA is quite understandable when it takes this form. Plus some of these TOTP apps make it hard to back up the data for use on another device, making a lost or broken phone rather catastrophic. Tip, when presented with the setup QR code on a site, decode it and just put the secret into your password manager instead of a phone app (in keepassxc right click an entry and it has a TOTP submenu). Can also be handy to save an image of the QR for later (do at your own risk of course, this is sensitive data) in case you need to set up TOTP again. People will probably argue this is less secure than letting it all live on your phone, but it still saves you from the most likely threat: websites being hacked and leaking your password. Also it's still protected by your password manager password, which should be unique and only accessible locally.