This may be an area where government regulation is needed, because otherwise service providers have the wrong incentives. Many service providers save a lot of staff costs (for staff who would otherwise be working on any aspect of recovery from account takeover attacks) by requiring a 2FA technology that's acceptable to a huge fraction of their user base. They have no economic incentive for allowing anyone to opt out of 2FA. Regulation might, for example, consider these three factors, among many others:<p>1. If users rely on the app for basic needs of existing in society, then 2FA must not be mandatory. A user who remembers their password, but has absolutely no continuity of any physical possessions or physical location, must be allowed to login (unless there has already been an account takeover that caused damage to the service provider). Some level of government subsidy might be available to service providers who can meet this requirement.<p>2. Apps that are more specialized or recreational in nature can make 2FA mandatory.<p>3. 2FA can be mandatory if the service provider does not obtain any revenue by offering the app.<p>(These are just initial thoughts, not a complete specification of what regulations would be reasonable.)