We all know what it is and we all should use it. Oh, and GitHub supports it now too. The problem is the de-facto app used for TFA - Google Authenticator. This thing is so bad that even Google doesn’t trust it:
This is not an ad but I just found out about Authy and it’s awesome and you should use it!