It's been a couple of years but I was able to set up 2FA for security keys (Yubikey and HyperSecu) and Authy (same as Google Authenticator but allows me to user more than one device to authorize). I then removed the phone number and backup email address.

Do they even let you enable non-SMA 2FA anymore? Last I checked the TOTP option was gone.

Yes, but first you have to enable SMS 2FA.

When you set up MFA, it doesn't provide TOTP as an option. If you enable it with a phone number/SMS MFA, you can go back into the MFA options and add a TOTP device then remove the SMS option.

Of course, at that point they still have your phone number...

On Google? Both totp and second device authentication are still supported.

Recovery email, SMS, TOTP, other 2FA. Now there are 4 ways to compromise your account. Awesome! And the solution, according to Google, is to pair those methods with some other arbitrary factors to make it really secure.

Just ignore the fact that almost every option is vulnerable to real time MitM via phishing if a user doesn't understand they're at the wrong URL. So what does Google do? They deemphasize the URL and train users to randomly enter their 2FA codes everywhere a million times per day. Brilliant!

In fairness to Google, the one mechanism that isn't vulnerable to phishing is the one that Google put a lot of work into designing, implementing, standardizing, and evangelizing, and the others were existing and easy-to-implement options.

> Now there are 4 ways to compromise your account.

No, there's 1 way which existed with just the email/password. But it's reduced by the number of people who do realise it's not the right page.

They also support FIDO/U2F, which does the site verification for you, and 2nd device auth which I don't believe you can trigger from a spoofed site.