Also
> We notified the Australian Government of this problem, and were told by the Australian Tax Office that they do not intend to make the recommended changes to their protocol. [1]
Aust Govt breaks multiple web-security 101 rules, bears no cost nor responsibility for it, and the cherry on top: they refuse to do anything about it.
App-based OTP and push seems like a reasonable middle ground, short of supplying everyone with FIDO keys. It’s still better than SMS or email - or no second factor at all.
I’m fairly sure the app does require you to enter a password after a set period or reboot - exactly like apple’s iCloud implementation (which IMO, is pretty good, or at least good enough for most individuals’ use cases).
Things are getting a bit confused lately though, as some models require that factors can’t exist on the same device, and there’s questions around keeping physical (‘have’)factors separated for different accounts and functions.