Everyone is talking about threat models but like the actual use case here is some web service that doesn’t matter very much that you use sometimes and if it was

Everyone is talking about threat models but like the actual use case here is some web service that doesn’t matter very much that you use sometimes and if it was compromised that wouldn’t matter either but they make you use some fucking login scheme that adds extra time to your day. Or even more accurately they insist on you using their own proprietary mobile app to get a code which really only exists to track you and make trouble when you log in from a different city or have a VA log in for you, spawning a call from them to try to insist on you buying extra licenses so you find the fine print link that lets you use a TOTP instead and get a few minutes of your life back every time as well as their useless fucking app off your iPhone.