2fa considered harmful

https://xeiaso.net/blog/push-2fa-considered-harmful

Good summary of the case for webauthn, and against 2fa.

Includes a note on Ethereum hidden at the end that was new information for me.