I've often been struck by the fact that often login via password requires 2FA but password reset doesn't (unless of course it works via email that itself requir

I've often been struck by the fact that often login via password requires 2FA but password reset doesn't (unless of course it works via email that itself requires 2FA to log into). At least some authentication systems now never bother with persistent passwords at all and simply rely on you providing a code sent in each login to your email (or occasionally still via SMS - though that's rapidly falling out of favour, at least partly because in many countries SIM-swapping a significant problem, though the bigger problem I've observed is potential delays of several minutes for codes to arrive). But I certainly wouldn't want that for systems I have to log in into multiple times a day - a combination of browser-auto-filled password, plus use of basic browser fingerprinting techniques to avoid having to require 2FA every time seems to work okay though it seems ridiculous to me that just wanting to reply to a group chat message would require the same level of verification as downloading source/documentation etc. A compromise between allowing users full control over their passwords and none at all would be generating a list of permitted alternatives and having them pick one. What I'd then like to see is that early on you are required to supply it quite frequently, giving you a chance to commit it to memory, but then allow having the browser store it or session cookies with longer lifetimes be used. But I've yet to come across a login system where ensuring the user learns their password and doesn't forget it was a priority at all.