For a long time, I vouch for non-2FA because I expect it to be against me earlier than being a benefit. Now, I have the mail server down. I need to login to repair it. I login and out of nowhere: 2FA. It sent the code to my e-mail. Ok, I'm fucked. So I call their phone number and that said "Sorry, we can't respond in person because of the high load (smth like that)". Well, this is an issue that an automated bot won't fix for sure.

This server isn't fixed anytime soon. But the 2FA, I knew it! Please make it optional and don't force it on users. Through e-mail is a bad idea by design, do a SMS or something, something that is not depended on the hosting services.

Yup the idea of this crap depending on a specific device terrifies me.

I run my SMS through an XMPP gateway I run via jmp.chat, so if that goes down I would be fucked for a bit too.

2FA is everywhere because the vast majority of people still reuse the same 3~4 passwords and can't even be fucked to come up with a deterministic password system, much less use a password manager.

I know deterministic password algorithms aren't the best, but a good one requires an attacker to get at least 5+ of your passwords to begin to figure it out (which is what happened to that one Gentoo maintainer).

Password managers still run into the same issue as 2FA. A cloud one could get hacked and an encrypted or local one could have you lose everything with one data failure.

@djsumdog yes, but I prefer that users are responsible for their passwords themselves instead of forced security. Including password requirements like special chars. All not needed, trust your users, push responsibility on them. Not agree? Make 2fa optional and regarding password strength, everyone has it in their own hands.

@djsumdog > 'Password managers still run into the same issue as 2FA. A cloud one could get hacked and an encrypted or local one could have you lose everything with one data failure.'

Quite true. Happened at least to LastPass, IIRC. Although, if memory serves, if one had a good master password they were safe.