lennier

It is actually included in the standard license, just the documentation for enabling it is quite easy to misunderstand (it mentions several times that it’s for business only, but what it means is needing to enable it is business only. It’s already enabled for standard users). Confused me too.

You also lose £2k worth of tax free childcare instantly as soon as you earn £100k, a rare instance of it actually being possible to earn less money by getting a payrise

Some companies main users that they want to protect are customers who consider security to be having one shared password written on the noticeboard in the office. Sadly, sms is just an easier sell to a lot of users, and even getting them to do that can be a nightmare.

As for why proper TOTP isn’t supported as well… the cynic in me gives you the answer “the auditor required we implement 2fa, we have implemented sms 2fa, now go implement shiny feature x instead of wasting time” is probably a common corporate response.