why is it 30 seconds instead of 60 seconds? I’m pretty sure every other TOTP I’ve seen is 60 seconds. My jaded take: the blind pursuit of “better security” even though… what does this even imply? Someone has 30 fewer seconds to read the code over your shoulder and log in on their device?

30 seconds is the default for TOTP implementations.

I’m curious to know what CRA does, but I’m away from my PC right now.

Yes, you can stop getting SMS messages.

edit: formatting