The internet needs a standard for setting up one-time verification codes. Apple should draft one.
SMS codes are effortless, but less secure.
One-time verification codes offer a more secure alternative, but require a password manager — and an initial handoff that lacks an internet standard.
Try this demo of an ideal handoff and verification codes in general: https://otpauth.dev
