@boblord I agree that a strong nudge in the MFA direction is very important for pretty much all services, but we have to be careful to not aggravate end users to the point where they resent these security policies and resort to unsafe practices.

Everyone, security pros and regular users alike, have been annoyed at some point in their lives dealing with a website with a terrible password system. Sign-up pages that won't accept passwords with special characters, tells us our password doesn't meet requirements without outlining what those requirements are, or necessitating a password change obnoxiously often.

If providers are going to get aggressive with pushing users to use MFA, it needs to be convenient. Give users the option of SMS, email, app, yubikey, etc. Give an option to remember their device. I doubt this will be a problem for big websites, but how many accounts does the average person have, something like 200? I doubt all 200 of those logins will be so convenient once we enter an MFA-required world.