you are viewing a single comment's thread
view the rest of the comments
[–] 3 points 15 hours ago

The real reason is conversion. The majority of users aren't good at technology, so you risk them losing their TOTP secret. Then the user either just says "screw this site" and leaves, or they take time getting customer support to reset their key.

So depending on the branch and customer base, it can often be much "cheaper" in the end to send login codes via email instead of using TOTP.

  • source
  • parent