Vultr must have the most stupid way of OTP management I've seen in a long while. You cannot delete an OTP token on your account if you do not have access to the OTP token. Let that sink in. If you try to delete a token from your account management, you need to enter the OTP value of that token to be allowed to remove it. Then consider a scenario where you've lost access to a hardware token, or like if your mobile holding the token has been stolen. The same goes for backup codes. This is quite a huge security fail. Of course, it could be I'm just stupid and haven't understood the account management panel. #vultr #infosec #otp #totp #fail (Luckily, I was just unfortunate and deleted the Vultr OTP in my OTP manager - so the risk is manageable + I'm moving away from Vultr, now definitely completely)