I am evaluating the idea of simplified second factor authentication by requiring a file to be uploaded, such as an image along with username/password. The file is stored on a user's device.
My reasoning is that this is faster/simpler than getting a code via SMS and entering it. Specifically, the user does not need to leave the login page to use another app such as an RSA generator or push notification, etc. The user would have previously submitted and stored a file that is not available elsewhere on the Internet, but is located on their device.
I am using HTTPS, but I do understand that a man-in-the-middle attack could cause the uploaded file to be compromised along with the username/password, so in that sense it is less secure than a code that was sent via SMS that expires in a few minutes and can only be used one time. And maybe that is the critical flaw.
I did find this post, but it wasn't very useful/specific (or current). A special file as the second factor in 2FA
I have spent several hours researching the subject of using an uploaded file as a second factor for authentication and found very little, so from this I assume there is something wrong or inferior about the idea. It is much more convenient for the user for frequent use, but what are the negatives?