Hi,
I like davelopware’s point on “authenticate challenge and only enable it if they can enter a valid authenticator code”.
On point “#3. Generate, for each user, a 16 character ‘backup’ code…” I have to vote for not having this feature.
It breaks the security model and recovery should direct to Google rather than circumvent whatever Google has set.
