<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>On Tue, Jun 14, 2022, at 17:15, Khalid Baheyeldin wrote:<br></div><blockquote type="cite" id="qt" style=""><div dir="ltr"><div>So TOTP with Google was not an option, because they require you to give them<br></div><div>a phone number and they send an SMS to it (at least initially).<br></div></div></blockquote><div><br></div><div>They probably require that initially for simplicity's sake since that is the most universally accessible option. However, it isn't required, at least at the end.<br></div><div><br></div><div>My google account has the following second factors configured:<br></div><div><br></div><div>* Multiple physical security keys (on me, safe backup)<br></div><div>* TOTP (which, upon review, maybe I'll disable. I don't it)<br></div><div>* Backup Codes (PDF in my encrypted safe storage)<br></div><div>* Android prompt (which requires me to unlock my device)<br></div><div><br></div><div>I specifically have SMS disabled as it is the least secure second factor.<br></div><div><br></div><div id="sig91988184"><div class="signature">-- <br></div><div class="signature"><b>Chris Irwin</b><br></div><div class="signature"><br></div><div class="signature"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;">email: chris@chrisirwin.ca</span><br></div><div class="signature"><span class="font" style="font-family:menlo, consolas, monospace, sans-serif;"> web: <a href="https://chrisirwin.ca">https://chrisirwin.ca</a></span><br></div></div><div><br></div></body></html>