A while ago I worked on the 2FA access feature of a large online service. The fun crypto-related and login-path stuff took maybe two weeks. The remaining mont

A while ago I worked on the 2FA access feature of a large online service. The fun crypto-related and login-path stuff took maybe two weeks. The remaining months were all about account recovery. It's really hard to do well, and unless you hire support staff it just won't work.