I agree with this sentiment. Steam notably falls into the third category, while otherwise being pretty good.
But I'm quite disgusted now seeing an image of a Yubikey for the first time. I've heard so many good things about them that it's a major disappointment to see now that they use that awful noncomplaint shape of USB plug.
There are two very important reasons for the metal shield around USB plugs: 1. For ESD protection, and 2. to hold the receptacle's tongue in place and prevent it from bending away and losing contact. Every USB device I've owned that was a flat plug (like this Yubikey image in this post) has within a month deformed the USB receptacle it's plugged into to the point that the device no longer works in that port. Compliant USB devices still work in that port's deformed receptacle, because they have a correct metal shield that bends the tongue back into the correct position.
Uuuuugh. I just had this problem after dropping my phone. Can't log into the phone without the phone being logged in. Solution: disable 2fa on a logged in device. If I can disable it from another device why can't I verify it from another device? This is so broken!
my favorite instance of google MFA was when i went to log into my google account for some reason. Google hit me with the MFA, cool whatever, i'll MFA, google does the usual "heres how we do it because we give you no options because fuck you" and im like, cool, ok just gotta wait for this to work.
And then it proceeds to not work, at all. Thanks google, very cool. Fortunately, i had a secondary auth app setup so i used that, and it worked, weird how that works huh? BTW, it wasn't sms, it's googles integrated android MFA service, which as far as i can tell, is literally a fucking requirement to using MFA.
Also, i remembered again, that logging into my google account, automatically logs me into every google account i have. Yknow, because security. Anybody know how to disable that one btw? Google seems to be an endless labyrinth of options everytime i try and do something with it so.
At work usually I can login without any input thanks to SSO, but occasionally it will ask for a security check. The default is to press a notification in outlook on my work phone, which I only ever use when travelling, so it's invariably off... 🙄
Sorry, as IT person I have to disagree, app based MFA is just way much easier to maintain instead of HW keys.
Edit: forgot to mention that in Finland companies here has to provide phone if your work require that. In IT I don't want nothing to do with users personal devices, and it sounds insane to me that in US companies force apps to your personal devices.