Choosing 2FA authenticator apps can be hard. Ars did it so you don’t have to Losing your 2FA codes can be bad. Having backups stolen can be worse. What to do?