The title pretty much says it all. I am currently implementing two factor authentication and wonder whether I should provide a list of recovery codes. I wouldn't even have thought of it myself, but most implementations I have seen in the wild do it this way. Github for example generates a list of 16 recovery codes at once.
Is there any security benefit?
Great question - I'm pretty sure it's an ease of implementation thing for both parties - if you generate a list of recovery codes up front then you don't have to regenerate a code every time a user uses a backup code. The idea is that the user will print/save them somewhere so from a usability perspective this saves the user from having to re-print or re-save codes.
You don't have to use recovery codes, though. GitHub supports a few different recovery options. Some companies use security questions or allow you to fall back to SMS. Some companies make you call support and provide account details (works for enterprise use cases where there's a trusted contact/if you expect to have a small number of account recovery cases/have a good way of verifying identity over the phone [disclaimer I wrote that post for Twilio]).
I gave a talk about this last year and have some more recommendations in the slides. Hope this helps!