2FA is great when you want it on an account. If it’s being forced on you however, it’s insanely irritating, often for no reason. The user should have the power

2FA is great when you want it on an account. If it’s being forced on you however, it’s insanely irritating, often for no reason. The user should have the power to decide if that information is worth the extra protection. To your point, what is an anti pattern is requiring certain special characters or a certain mixture of character sets while ignoring other valid safety approaches such as password length IMO. Regardless, if a user is constantly resetting their password due to forgotten password, that amounts to 2FA because of the emailed reset tokens anyway. Modern users have adequate access to password managers that it should be simple to put them back in control.