> Wait, you seriously feel all these "your password must have x, y and z, confirm it, scan QR, enter digits" as convenient? Requiring certain character classes

> Wait, you seriously feel all these "your password must have x, y and z, confirm it, scan QR, enter digits" as convenient? Requiring certain character classes is not mandatory for a password. The 2FA initial setup could be improved slightly, but it's not that much worse than your entire login flow, and it has actual security benefits. > Everyone in the world knows auth is broken. Well apparently not. > There's no reason for this to happen There's no reason for you to dismiss valid statements about external risks as "There's no reason for this to happen", and yet that happened, didn't it? > Which one is your favorite? I'm sorry, are you analysing the best open source license to use for your code, or taking a lunch order?