Hacker News Reader

The first general-user services to enforce 2FA of any kind will be sacrificing a massive number of users to do it. As a company running a service for money, you have no incentive to make your system more secure on the user end - obstacles for the user are just users lost.

Security-conscious users can push for 2FA on services, but we probably won't hit it being mandatory any time soon.

View on HN

But if there's any money at stake, then any money exfiltrated from your users is money that you never receive, so there's certainly an incentive but also trade-offs.

Assuming

1. Your profits come directly from your users

2. A password crack can result in them losing a significant amount of money, and

3. This happens often enough that it offsets the userbase losses of 2FA

If your user accounts are important enough to let them lose a large amount of money, your users are probably demanding better security from you already. The real blocker to 2FA are services which rely on being convenient, and make money off their users being users e.g. social media.

Reply on news.ycombinator.com