What really bugs me is that TOTP is objectively easier than any other form of 2fa. Just import the library, add the field on your login form, and you're done.

• Email verification is annoying to code, it requires SMTP or an email gateway, is slow for the user, is risky from a security perspective, and to generate the code you probably still have to implement TOTP.
• SMS/RCS is even more annoying to code, it almost inevitably requires a third-party gateway, it can work differently if the user is in a different country or on a MVNO or in a low-signal area or just has the wrong astrological sign, is very slow for the end user, is almost useless from a security perspective, and you STILL have to implement TOTP.
• WhatsApp messages are somehow even more annoying to code than that, requires an api interaction with Meta (which is never fun and poorly documented), requires the end user to have an account with a specific third party, is slow for the end user, relies on another company's security posture to determine your own, and you STILL have to implement TOTP.
• Making your own app for 2fa is undoubtedly the worst: not only is it annoying to code, it's an ongoing annoyance that is strained through multiple app stores, adds an additional maintenance and support load, adds additional technical debt, adds an unnecessary attack vector, requires users to download another app, is often unreliable, is often pretty slow for the end user, is a total crapshoot from a security perspective, and guess what? YOU PROBABLY STILL HAVE TO IMPLEMENT TOTP.

Any company that chooses SMS or email verification over TOTP emphatically does not know what they're doing.

Except that it needs another jump for autofill 2fa

Seriously. Why would i care if someone logs into most of them. What are they going to do watch a movie on my Netflix account, play my kids roblox games, or change my crew on my Rockstar account? It's unnecessary bs.

E-mail based 2fa isn't good, but at least it's better than having no 2nd factor at all.

Reminds me of all the times I've run into "Please provide another email address we can use to verify your signup for this email address."

So I can't have an email address unless I already have an email address. It's the most asinine thing

Good thing you aren't in charge of anything, then.

Although I personally think 2FA is very important in most cases, I agree that mandatory 2FA is annoying. If you want to forego security for convenience, that should be up to you. I'm sure you're not stupid or ignorant of the risks.

As a user its annoying, as a developer it is incredibly frustrating and time consuming.

This is uterly idiotic but ok. I have decided I do not need to wear seat belt in the car. Just because you do and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.