I agree, for personal use cases, RFC standard TOTP that can be backed up and managed by the user is the ideal balance of security and availability. Enterprise

I agree, for personal use cases, RFC standard TOTP that can be backed up and managed by the user is the ideal balance of security and availability. Enterprise TOTP apps like Okta and MS Authenticator have some enhancements. Push notifications are convenient when you have to access things many times a day. More importantly, push notifications with a number-matching confirmation reduces the chance of TOTP poaching, since the user themselves are interacting with the service requiring auth. In enterprise environments, there should be a restore process for a lost phone or authenticator. Some kind of backup code with voice/manager approval, or coming into a physical office to reset credentials. This isn't available for regular people/regular retail services except maybe banks, but banks can't even do regular TOTP correctly.