the Authy 2FA isnt bad, but U2F would be even better. with U2F one can use a hardware token (usually over USB) to sign in, and the best thing is that it’s almost impossible to do phishing U2Fs, because the browser has to be convinced that
a) the login is actually dash.cloudflare.com (or whatever domain selected)
b) the connection is HTTPS.
I would also like to see this, especially with the upcoming launch of Cloudflare Domains, there will be valuable assets in CF accounts now. U2F is phishing resistant and provides the highest level of security, something I think Cloudflare should be interested in
I would like to add that since Cloudflare is not only a domain’s authoritative DNS, Cloudflare is also a domain registrar which will increase the damage a potential account takeover could do.
I use Authy (and have just about 80 2FA in that account) but also have a Yubikey and another 15 or so logins using it. I would like U2F support as well)