@hacks4pancakes @initinfosec @BadassBowden Yes, & the apparent acceptance by general industry that it's OK to set it up as the *only* option, rather than also supporting U2F and TOTP at the same time. At best, you get a dedicated app which does god knows what We're building a nightmare somewhere down the road I suspect.