Fuck the 2 factor bullshit.
I've lost many accounts just because I moved to another country and changed my number.
I still know the password, It is my account but I can't login just because the asshole who created 2 factor authentication never moved out of his parent's basement.
While true, other scenarios do come into play, like "I'm using a FIDO key but I dropped it down a storm drain". Meaning you pretty much have to provide some recovery mechanism, since you can't really require the user to have a backup device.
Fuck the 2 factor bullshit. I've lost many accounts just because I moved to another country and changed my number. I still know the password, It is my account but I can't login just because the asshole who created 2 factor authentication never moved out of his parent's basement.
SMS based 2FA isn't recommended and with an authenticator/hardware token your scenario is not a problem.
While true, other scenarios do come into play, like "I'm using a FIDO key but I dropped it down a storm drain". Meaning you pretty much have to provide some recovery mechanism, since you can't really require the user to have a backup device.
That's why it is called multi-factor