Perhaps there's a lot more criticism in the implementations of two-factor authentication. One example is GitLab allowing recovery code generation with just a SSH key.
The places you'd expect good multi-factor authentication seem to have it the worst: PayPal hides and fights against you adding two-factor authentication. You need to head to a hidden URL and use Symantec VIP as the software token, or hack around it with python-vipaccess. No backup codes either.
Possibly my worst experience has been with my credit union. To even get two-factor authentication I needed to call them and ask for them to enable support for it on my account, then set it up while on the phone.
They don't have backup codes either, but since I can call them I'm not too concerned about this as much as I would be with PayPal.
After setting it all up, I found the second factor is only used in special circumstances such as changing my password or sending money to new recipients.
Welcome to thundertoot! A Mastodon Instance for 'straya