TOTP is a bit of an annoyance though a pretty rare one all things considered as most sites have reasonable delays before they ask for re-authorising devices.

The biggest issue is that as the number of sites in the Authenticator grows finding them becomes more annoying.

Keys are a pain in the ass though, as their form factors usually make them impossible to keep attached to a laptop (as they snag and break if you forget to unplug them before putting the laptop in a bag), yet easy to lose if you’re not super careful.

There are low-profile keys (yubikey’s nanos) but they’re not exactly cheap, and I’ve never seen one being given out (whereas I have free keys from older programs of github and google both).

They’re all minor gripes, but they’re routine annoyances nonetheless, and as the number of sites requiring 2FA grows (rightfully so) the likelihood that you’ll meet a 2FA prompt every day closes in on 1.

And there’s a handful of sites which are really shit about it, with way too aggressive requirements and way too short sessions.

I’ve got great hopes for TPM WebAuthn.