Since 1994, before any of these schemes even existed:

https://events.ccc.de/congress/2009/Fahrplan/attachments/151...

I wonder why Telegram (and Twitter) doesn't allow the use of third party MFA providers just like LastPass.

https://helpdesk.lastpass.com/multifactor-authentication-opt...

I'll never understand why LastPass requires you to be a premium user to use some forms of their 2FA (for example, I can't use my Yubikey if I don't pay for a premium, and I don't need a premium account for literally anything else).

Well, a lot of MFA is done through SMS. I believe sides like Tumblr and Twitter do that? At least I am asked to do SMS authentication for those sites. Maybe it's a setting I checked off.

NIST says SMS is not secure enough for 2FA

http://www.cnet.com/news/nist-set-to-ban-sms-based-two-facto...

Thanks. This is a good reference I can share with folks internally.

And yet it is the only kind of 2FA offered by any of the "serious" institutions I do business with. TOTP is only available on toys, other than AWS. Sigh.