[lotsofpulp]

So make it a non default option? No one who doesn’t want to use TOTP would even have to know about it.

I know some services require SMS in order to force collection of user’s phone number, for data selling purposes and to prevent bots.