We'll stop asking for a password, even! But honestly: If the "remember this session" button is checked as it often is for apps and sites, you should only have

We'll stop asking for a password, even! But honestly: If the "remember this session" button is checked as it often is for apps and sites, you should only have to do it every once in a while. Or, if the site is a bit more clever, you may only have to 2FA on sensitive screens, such as "edit personal data" or "make purchase" or "transfer money". The nice thing about "non-push" TOTP is that it does not require any external service. A site could generate its own TOTP keys, show you a QR code and let you use any app (Authy, 2FAone, Google Authenticator, etc) to manage those codes. And your phone can be offline and still work with it, and you can back up your own 2FA keys. "Push" based 2FA requires a service, typically paid, like Okta or RSA.