> Do you value security, or do you value convenience? And in what proportion? Or to look at this from the threat analysis side, there are many different threat

> Do you value security, or do you value convenience? And in what proportion? Or to look at this from the threat analysis side, there are many different threat models and not everyone has the same ones. This is why it is so wrong for these cloud services to consider only one single threat model and impose it on everyone. Denial of service is also a consideration in threat modeling and 2FA does increase the risk of loss of access. Whether that's worth it depends entirely on other factors which will vary for each individual and group. It's never a clear cut answer. Personally I have TOTP enabled on my github account (not on a phone, that's too fragile) but that's because it makes sense for my use case. There are other provider accounts where I have no desire to ever enable 2FA because I value access from anywhere with only my memory far more. Cloud providers should not be making threat modeling decisions on behalf of users, each user needs to make their own. Another reason to self host most things, you can implement your own best policy.