[badsectoracula]

Actually my main concern is the reliance on 3rd parties - requiring a mobile phone is an implicit reliance on a lot of 3rd parties that IMO should not have any business where/how i authenticate myself.

I don't know about TOTP but if it can be completely independent from 3rd parties and can be used locally like private+public key signatures can then i guess it is fine.

[eesmith]

"TOTP for 2FA is incredibly easy to implement. So what's your excuse?" shows how to do it in Python. https://drewdevault.com/2022/10/18/TOTP-is-easy.html .

Though Python would be a 3rd party dependency. ;)

HN comments about that article at https://news.ycombinator.com/item?id=33245042 . Including some of the problems people have had with 2FA usability.