Website owners believe that your account on their website is the most important thing in your life, I guess. Personally I never enable 2FA. I've even disabled

Website owners believe that your account on their website is the most important thing in your life, I guess. Personally I never enable 2FA. I've even disabled it on my google account, after it had been forcefully enabled. I think the chances of me losing/breaking my phone are higher than the chances of an hacker hijacking my account. I'm completely ok with having 2FA for my bank account, or similar things. There are important differences there: * A bank has an office where I can show up with an ID if my 2FA should fail. A website will just lock my account. * The stakes are much higher * I have the option to have a hardware token that is NOT my phone. As a side note, totp 2FA is the best kind. It's easy to back up (if you don't use google authenticator).