First, it is a good idea to setup the authentication on multiple devices. This is not hard to do.

Second, if that happens you are in the same situation as with the phone authentication -> so the disadvantage is the same.

It's not possible to have Google authenticator on multiple devices with the same accounts on it.

It's easy to transfer from one to the other but that doesn't remove the single point of failure.

Solution is to have back up codes for each account.

You can just scan the QR code on multiple devices during setup. I have an old junker phone that I use just for this and being a universal remote that never leaves my end-table.

This is how I do it.

But of course, keeping emergency codes is a good idea too.

I use KeePassXC to store and create my TOTPs. If needed, I can (painfully) type the underlying hash into any app.

This is a problem with Google authenticator, not with RFC 6238 TOTP in general. Plenty of authenticator apps support backing up your secrets.

Indeed. I’m trying to move from Google Authenticator to Authy for that reason - but the inability to backup/export from GA is a PITA... a cruel form of vendor lock-in.

If you are switching authenticator apps, I would suggest switching to one that respects your freedom, such as Aegis, andOTP, or KeePass.

It's worth also noting that Authy also has no official way to export your secrets, although there are workarounds: https://tij.me/blog/migrating-your-one-time-passwords-from-a...

No. For two factor authentication to work the solution needs to be practical for most people. So it can’t involve multiple phones or backup schemes most people aren’t going to implement.

Otherwise you’re going to lock a lot of people out of their accounts which is not acceptable.

Ultimately this typically ends up with a reset scheme that depends on phone numbers or email addresses which means the protection, which is as strong as the weakest link, is worthless.

Your company is usually given a privileged management interface to reset it for you.

If you work for an organization with their own PKI then there’s probably also an automated self service reset mechanism using a complicated process.

I strongly recommend Aegis on Android. Encrypted backups of the TOTP config, so you can easily recover it all if you lose your phone without having to reset everything, plus biometric support to unlock it.

Backup codes on a paper in your wallet. Multiple devices.