Case in point: I was required to add a phone number to an account before they would let me use an Authenticator App. If you’re securing your account, the standard should be that an Auth App is agnostic of other user data. It doesn’t need your phone number, it doesn’t need your user ID, it just needs the secret key.

And I was thinking all along, “What if I didn’t have a phone number? Are people who can’t be reached by phone just not allowed to use TOTP?”

It’s needlessly discriminatory.