> SMS 2FA is a joke tho. Yes, everyone knows. But it's better than nothing.

Not always. If the provider can be social engineered into granting you access to the account after proving access to that number then I’m not sure “better than nothing” is that solid.

It's potentially worse than nothing because you can steal someone's sim card and then use that to reset their account password. This is because (as in almost every company that uses text messages for 2fa) you use the sms to authenticate the reset.

Better than having a strong password bypassed using shoddy recovery procedures.

Of course, that means it's not 2FA, just 1FA.

Or these shitty fake 2fa photo tan things they have here in Germany.

Something you have (your phone, with saved passwords) and something you have (your wife's phone, or just a device to take a photo of your screen to show it back to your actual phone) isn't 2fa.

But it makes it so painfully difficult to do anything that a valid step for security, like quickly contacting the bank to say “my phone is untrustworthy” via another device, becomes unreasonable, difficult and unlikely.

(But in general, trying to do anything in Germany is a painful experience. The business culture here seems to be, “if it's beneficial to the customer, it's a cost centre to us so please remove it”.)