* U2F token (primary method)
* TOTP via phone app (backup)
* Backup keys printed or on encrypted USB, in a safe.
* SMS disabled explicitly.
TOTP fallback doesn't reduce security meaningfully, because U2F principally protects against phishing. But SMS fallback is devastating to security.
* U2F token (primary method)
* TOTP via phone app (backup)
* Backup keys printed or on encrypted USB, in a safe.
* SMS disabled explicitly.
TOTP fallback doesn't reduce security meaningfully, because U2F principally protects against phishing. But SMS fallback is devastating to security.