Well, it depends...
Who is locked from using his account=>@OP
Who is fine without => Me
Great, and I don't have any alligators in my backyard because the alligator replant is working like a charm.
As with anything in tech, if you have a backup your pain will be greatly reduced when the shit hits the fan. Any device can get lost, stolen or broken, but that doesn't mean you shouldn't use them.
If someone steals your laptop with your hot wallet on it and there's no 2FA, they're gone. If someone steals my laptop, they just stole themselves a 5 year old laptop. Congrats. I'll import my backed up keys and my life goes on.
Edit: oh and your online banking, Amazon account and Facebook were all logged in. The attacker now has a full list of your friends/family, all of your banking details , your bitcoin wallets and your address. I sure hope they're a friendly criminal and not one of those nasty ones.
That's poor logic. 2FA should be mandatory on every CEX no matter what.
I heavily disagree with that.
2FA's whole purpose is to be a second layer of security in case of the password getting leaked.
A user with security in mind and a password which does not composed of the name of a pet + 123, does not need 2FA at all.
If the password is secure AND one can somehow 'guarantee' that their system will stay safe, 2FA is no way necessary.
Regarding 2FA as mandatory is a wrong approach. 2FA won't help you if you are doing everything without security in mind.
I agree with 2FA as a second layer being more
tough to hack into, but it is BY FAR not impossible.
That's one purpose. Another purpose would be so that no one can log into my account unless they have my physical key. That takes care of "the internet" as an attack vector and my ultra long random password will take care of brute force attacks.
Also, how many people out there can "'guarantee' that their system will stay safe"? If I said 1% of the population I would be
grossly overestimating.
There is no downside to offering 2FA. (No - the extra 10 seconds it takes for you to log in is not a downside).
For those that are interested, Google uses physical security keys just like any other security conscious company. If your company doesn't and you're dealing with sensitive data, you may want to nudge them in this direction.
https://www.extremetech.com/computing/274067-google-eliminated-phishing-by-giving-all-85000-employees-usb-security-keys