Do you guys not have phones?

There are so many sites that force you to use the SMS 2FA, and I hate it!

For some logins I value so little i don't even care to have a password on it, I really don't give a shit if SMS isn't secure.

Heh tell that to microslop. Every time you gotta log in to the college website. It feels so secure...

this is like when you have to call a customer service phone line and they tell you to try the website

Never seen that one ooof

There isn't any good reason, it breaks password managers. Just give people with special accounts their own log in page.

Microsoft oauth login in a browser: type in password, get pop-up "reusing passwords is a security risk. Change password now?".

I sure wonder why the password to my AD account is the same as the password to my windows account. It's almost like they're the exact same account or something.

Except that it needs another jump for autofill 2fa

What really bugs me is that TOTP is objectively easier than any other form of 2fa. Just import the library, add the field on your login form, and you're done.

• Email verification is annoying to code, it requires SMTP or an email gateway, is slow for the user, is risky from a security perspective, and to generate the code you probably still have to implement TOTP.
• SMS/RCS is even more annoying to code, it almost inevitably requires a third-party gateway, it can work differently if the user is in a different country or on a MVNO or in a low-signal area or just has the wrong astrological sign, is very slow for the end user, is almost useless from a security perspective, and you STILL have to implement TOTP.
• WhatsApp messages are somehow even more annoying to code than that, requires an api interaction with Meta (which is never fun and poorly documented), requires the end user to have an account with a specific third party, is slow for the end user, relies on another company's security posture to determine your own, and you STILL have to implement TOTP.
• Making your own app for 2fa is undoubtedly the worst: not only is it annoying to code, it's an ongoing annoyance that is strained through multiple app stores, adds an additional maintenance and support load, adds additional technical debt, adds an unnecessary attack vector, requires users to download another app, is often unreliable, is often pretty slow for the end user, is a total crapshoot from a security perspective, and guess what? YOU PROBABLY STILL HAVE TO IMPLEMENT TOTP.

Any company that chooses SMS or email verification over TOTP emphatically does not know what they're doing.

A local marketplace service in brazil only allows me to login using whatsapp codes or sms. When i enter the passowrd they ask for a whatsapp code

Reminds me of all the times I've run into "Please provide another email address we can use to verify your signup for this email address."

So I can't have an email address unless I already have an email address. It's the most asinine thing

E-mail based 2fa isn't good, but at least it's better than having no 2nd factor at all.

Seriously. Why would i care if someone logs into most of them. What are they going to do watch a movie on my Netflix account, play my kids roblox games, or change my crew on my Rockstar account? It's unnecessary bs.

Although I personally think 2FA is very important in most cases, I agree that mandatory 2FA is annoying. If you want to forego security for convenience, that should be up to you. I'm sure you're not stupid or ignorant of the risks.

As a user its annoying, as a developer it is incredibly frustrating and time consuming.

This is uterly idiotic but ok. I have decided I do not need to wear seat belt in the car. Just because you do and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.

Good thing you aren't in charge of anything, then.

Ok, use the classic "bad username or password".

Or just properly rate limit so hackers can't just slam the long in page with a zillion combos.

I use vanilla Chrome (no extensions at all) on a dedicated Windows install. It's specifically for certain email accounts, government, banking, etc. Important real life business. I do that specifically so their software can run whatever the fuck unobtruded. Still some accounts will not stay logged in.