Facebook had allowed security key support for ... Typically, an SMS code is sent to your mobile phone or Authenticator app. "It's much harder for a bad actor to obtain both factors, which keep ...