I try to take a reasonable stance and be fair on these sorts of issues. I fully understand that I am on a pretty extreme end of the technical spectrum and don't expect everyone to do as I do. Even tho...
I imagine most people are still using a single email address for everything and very poor passwords, probably the same couple variations everywhere. I try to think about the liability associated with some systems. Like it pisses me off that my bank forces SMS 2FA activated (even though I have OTP enforced - they really should let me deactivate it if I have something better and reactivate if that changes, but whatever), but I also get that the alternative is to just let their average client get fucking annihilated.
1
