Getting 2FA Right in 2019

Most importantly of all: the fact that TOTP is not as good as a hardware key is not an excuse to continue allowing either SMS or voice codes. TOTP and WebAuthn are both solid choices for adding 2FA to your service and, given the opportunity, you should support both. This, plus TOTP’s relatively simple code-generation process, makes it a breeze to implement, but results in some gotchas:

By contrast, WebAuthn uses asymmetric, public-key cryptography: the client generates a keypair after receiving a list of options from the server, sends the public half to the server for verification purposes, and securely stores the private half for signing operations during authentication.

Source: blog.trailofbits.com