On February 1, 2026, I set up second-factor authentication for the new Itch.io account that I created to publish my first original visual novel, Little White Lies (a collaboration between me and our own Victor V. Gurbo). Itch allows for a single form of second-factor authentication: TOTP. I have set up TOTP for many services, so many in fact that I published an article about my TOTP workflow last September. I also once set up TOTP for my personal Itch account, so there is nothing new under the Sun. Because I am a TOTP veteran, I have no need to read instructions for how to set up and use the codes. It would take something unusual in the instructions to catch my attention. See Itch’s instructions below:
Here, something jumped out to me. Itch, like many services, recommends specific authenticator apps, most commonly Google Authenticator. People in the know like yours truly know that there are other options out there, like my preferred Android solution, Aegis Authenticator. But recommending Google Authenticator as the default option is reasonable in a practical sense. What struck me was the second recommendation: Authenticator on Windows Phone.
I never had a Windows Phone, but I knew that it had died some time ago. I learned while researching that Microsoft stopped supporting Windows 10 mobile on January 14, 2020, several months before The New Leaf Journal went live that April. I spotted the Windows Phone app recommendation on Itch on February 1, 2026, just over 72 and one-half months after the last version of Windows Phone ceased receiving security updates.
When did Itch last check in on its 2FA support page?
While Windows Phone was the first thing that caught my attention, it was not the only thing. See its non-Windows Phone recommendation: “Google Authenticator on iOS, Android, and Blackberry.”
Back when Windows Phone was discontinued, my primary phone was a BlackBerry Classic (I have published many BlackBerry Classic photos). My BlackBerry Classic ran BlackBerry 10, although some contemporaneous later BlackBerry phones ran Android (the Classic could run some Android apps, however, see e.g., my articles on using Open Camera App and KDE Connect on my Classic). I continued to use my BlackBerry Classic until (I think) early March 2021. While some people had commented on the fact that I was using a BlackBerry in the mid-to-late 2010s, I submit for the record that it was supported until January 4, 2022 (as I wrote about at the time). Itch.io’s BlackBerry reference is now just over four years out-of-date, but slightly less out-of-date than the Windows Phone reference.
Despite the out-dated 2FA recommendations, Itch.io’s TOTP on-boarding works well (it also provides emergency codes as a backup, which is good practice in my humble opinion). With that being said, unless Itch.io knows something that I do not about a significant number of its users somewhere in the world still rolling unsupported Windows Phones and BlackBerry 10-powered devices in 2026, I would recommend updating the app recommendations, or at least moving the TOTP app recommendations for devices/operating systems that have been unsupported for 4-6 years or more to a separate section, if for no other reason than to prevent me from doing a double-take and researching when Windows Phone was discontinued as part of a new article project (it is never too early to start gathering facts for my end-of-year Things I Learned article). While Itch is in the area, I would humbly recommend adding a few additional TOTP app recommendations, although I do credit Itch for listing Google Authenticator as an option instead of implying it is the only option (I have seen many other sites do the latter).
In any event, all is well that ends well. Both of my Itch accounts are protected by 2FA and Itch’s 2FA instructions gave me something to write about.
