[stephenr]

What PII?

You store a TOTP secret on your <device>....

It's less PII than an ssh public key because it's literally just a random string, that *they* generated, and you only need it for the web UI.

So please tell me how the Americans are going to track and identify you through a fucking TOTP secret.

[bjourne]

My phone number dumbo.

[stephenr]

Why would you use a phone number for 2FA. It's like saying you only use md5 hashing for passwords.