I just downloaded Facebook's new paper and got a text+email notifying me that I had now (unknowingly) activated the Code Generator. After realizing this wasn't spam - I realized this features enables me to reset passwords etc from my phone (making it the point of control). From a security standpoint - does it make sense to force a user to default to mobile as the primary security key for my account?