2FA on the login form is a thing for some sites,

2fa by email is probably slightly easier than TOTP, if the account verification via email is already implemented, but yeah, it's not like it's significantly easier...

You don't have to implement totp for these alternatives... The "thing" about totp is that there's a shared secret and a timestamp. Due to potential drift in clocks you need a window and period to know how many time steps to test, and how long each is.

But with an email/SMS/WhatsApp, there's no shared secret. So you can simply send a random code, and store server side when it was generated. Totp makes no sense in that case.

Not that totp is difficult to implement at all. My implementation for work was what, less than 200 lines of C++ I think? I didn't implement the sha1 myself though.

The real reason is conversion. The majority of users aren't good at technology, so you risk them losing their TOTP secret. Then the user either just says "screw this site" and leaves, or they take time getting customer support to reset their key.

So depending on the branch and customer base, it can often be much "cheaper" in the end to send login codes via email instead of using TOTP.

The bigger issue is gaining account details and personal info for identity theft.

Any account that does payment (like your netflix one), will be used to test out stolen credit cards. This will in turn flag your account for fraud. You might not want that. Unless you do, I don't know

They log into your netflix account, change email and password, and sell the account with your card still linked. Netflix support right out refuses to remove the card, or reimburse you for the remainder of the period you've paid for. I had to block netflix from my bank overall. I guess they don't want customers.

(This was all right before they implemented 2FA)

Well yeah, Netflix knows it's super annoying when your watch history gets messed up. This is the real reason why Netflix (and all the other tech companies) are suddenly pushing so hard for passkeys... it has nothing to do with how much control and influence it'll give them ;-)

It's not about a specific account, it's about compromising your info.

The info one company considers enough to verify you when you call or chat with customer service, another company will give out freely. They can then hop and skip through those to get access to one of your accounts they actually want.

Your entire online security is only as secure as your most insecure account.

Tell me that at least you use different email and password for every account because if not, then you just get screwed when they hack one account, also, if any of your social accounts gets hacked, it will for sure be used to scam or hack other people.

as a developer it is incredibly frustrating and time consuming

Huh? How? Implementing OTP (which I'm assuming most people here are talking about) is pretty trivial, and once you have it set up, it doesn't require much maintenance.

It fails for somebody every day, it adds a dependency for a known unreliable 3rd party that often mangles the identification data it sends back, it is exploited by that 3rd party for extending their monopoly, and it gives that 3rd party (or any hacker that got access to them) full access to impersonate any user it wants.

there, now you are getting it.