You misworded it. 2FA is f-ing stupid. Because everybody needs instant gratification and have to have all of their devices be able to log in, all these ports have been opened to allow more hackers. So, people like me, who only use a PC to access sites and can wait until I get home or use my PC, have to deal with 2FA, which sends a code to my phone, which I have to go find. So, two devices being used, requiring another device access.
I was thinking this rant would make me feel better, but it doesn't.
That's not really what 2FA is for or how it works. It's not because people have many different devices they log in with (though that can trigger it).
There is a "maxim" in computer security that you protect access using 2 separate things: something you have, and something you know. You know the password, so it needs something you have. Many 2FA systems send you a token of some sort by email or text and you now "have" that token and can produce it. Some systems ALWAYS require it. Some allow you to whitelist a successful previous login so that if you try again from the same "source", it will not use 2FA but just a password. For those systems that allow you to whitelist your last successful source of login, if the system cannot determine that you're coming from a whitelisted source, it will activate the 2FA.
So if you are using multiple devices all the time, the system will most likely trigger it since you're not coming in from the same source every time. But even if you only use the same PC every time if you have the browser safety options up on high settings or are using "private browsing", the system is not getting the info it normally would to ID you so it will always trigger the 2FA. And some ISPs also will scramble source addresses or not pass certain meta data on which also means the system cannot ID you and hence triggers 2FA.
2FA is a good thing actually. It makes it harder (but not impossible) for bad actors to hack into your accounts. Not only here but also your bank account, credit card account, your government accounts, etc. Password leaks happen all the time. If the password is the only thing needed to log in then anyone can use your account if they have the passwords, for example, from a password leaked list for sale on the dark web.
You may have noticed a lot of systems have stopped using passwords. They use your email address or username as the thing you know, and send you a login link to your email account and if you have access to the email account, they assume it's safe and the thing you have is the login link with the correct tokens attached that they sent you. Taco Bell, McDonalds, etc seem to have moved to this, as have some of the job application systems (like the one Oracle runs) and many others.
Not all 2FA are as safe as others. Your phone number is not inviolable so someone can hack your SIM card and get your texts and so the 2FA code texted to you can be intercepted. It takes more work that just stealing a password but it's not perfect. A lot of well known hacks where journalists or "known" people have their could account (google, iCloud etc) and are able to hack teh SIM and clone it or whatever and once they control your Gmail account or iCloud account, they now can get emailed tokens to it from your bank, etc.
I know that some people don't like "Passkeys" but they are the safest and easiest way to avoid normal 2FA and to be able to get in to your accounts. A lot of banks and cloud services and many other services, including this forum, have adopted Passkeys. They really are your best bet and if you use an OS that has unified Passkey access, you can share your Passkey across your phones, tablets, and PCs/Macs. If you have a system were each device has it's own non-shared Passkey, some systems will allow you to use your Mac or PC to access a Passkey protected site, and you don't have the Passkey on the system, but do on your phone, the site will put up a QR code, and you can scan it with your phone and the phone will negotiate the Passkey with the site. Once successful, the site lets your PC / Mac in.
You really should adopt Passkeys where you are able to -- on all sites that support them. They are the safest way to protect your account and also much easier than 2FA systems that rely on an email or phone to get a code.
Passkeys are a cryptographic construct that, once set up for a particular site, allow your device and the site you are reaching out to and trying to log in to to negotiate a safe and secure login for you and don't rely on any external codes or passwords. Here is more info:
https://en.wikipedia.org/wiki/Passkey_(credential)
Rant off.
