Hacker News new | ask | show | jobs
by Sebb767 1633 days ago
You actually can't mix hardware tokens and OTP apps. You're only option is to scan the code twice and skip hardware tokens entirely (which is quite reasonable, as the recovery for an app would be easier than for a failed/lost hardware token).

Note, though, that the new SSO login actually supports MFA in a normal way.