> They're invented.... until they happen. Well at least we're agreed your entire argument is based on made up theoretical scenarios, rather than the real world

> They're invented.... until they happen. Well at least we're agreed your entire argument is based on made up theoretical scenarios, rather than the real world, where people's accounts are breached because of poor password security, literally on a daily basis. > Passwords used correctly aren't less secure than passwords + 2fa. What was that about acting like you're hot shit? There is essentially zero way for you to know that passwords are being "used correctly", because "used correctly" includes how they are stored and transmitted. You have no view into how the remote side stores or transmits passwords though. For all we know (yes this is a hyperbolic theoretical scenario), GitHub stores all passwords in plain text. Or md5'd, or some other equally laughable scenario. Or perhaps they log passwords during authentication. Or perhaps there's an unencrypted path between a load balancer and a backend application server, which is open to packet sniffing by peers in a datacenter, or any number of other issues that have shown to be real-world points of weakness to a password. A big chunk of the benefit of TOTP based 2FA is that it greatly reduces the risk of replay style attacks. If you get the OTP I send (through logs or packet sniffing or whatever) it holds no long-term risk. > Well at least you're being honest about not caring about others. Straw man much? I didn't say I don't care about others. I'm very comfortable with the level of help/advice/expertise I offer to people who ask for it. Nowhere in any comment I've seen on this post, has anyone asked for help or advice. A number of people have made ridiculously misleading, uninformed or just outright false statements, with absolute confidence. Hence why I said (in another comment, but still a reply to you): > I'm blaming humans for wilful ignorance and insisting that there is no solution to problems they haven't tried to solve. > there are more scenarios than you can imagine. I'm sure there is probably some scenario where having 2FA enabled is a strictly worse scenario than password security alone. But you'll want to have a pretty damn strong argument prepared, based on a real-world scenario before you should expect others to listen to what you have to say and take it seriously. Right now you sound like a kid making up excuses about why they can't eat their vegetables.