Hacker News Reader

I hate the tendency to demand phone number to activate two factor. I see no practice reason why not simple TOTP isn't good enough. It's probably not a practical reason though...

Probably want phone as fallback auth for the inevitable people who lose their TOTP device and didn't save any emergency codes.

That could be setup as an option. The fact that there is no option provided and a phone number is mandatory means that they want to be able to track people with a globally unique identifier.

They should use TOTP, no need for phone number. It also can protect you if your password have been leaked.

https://en.wikipedia.org/wiki/Time-based_One-time_Password_a...

They changed it so you can now use regular TOTP through Google Authenticator or whatever. That's what I use.