[backslash]

Very Happy to see 2FA on SSH becoming more and more popular. One of the primary reasons my team has seen smart phones being used as the soft token is the ease of deployment argument, people already have the phone with them. With Yubikeys (not that they are cumbersome) but for some IT groups the "perceived" hassle involved (if a key breaks and have to reissue a new one) is a concern. You can lose your phone too, but some customers think that a phone has more chances of not being forgotten. We've also seen IT groups being quite comfortable using soft tokens because they have been using them for SaaS apps - whether its authy/GA or anything else, I guess familiarity kind of desenstizes the analysis of a risk vector.