Yeah no. We've arrived at this point in time where username/email with password login is considered not good enough and so if you login from a new location, you'd have to submit a one-time password from SMS or a 2FA app (fine if it's just standard TOTP, extremely jeeted if it requires specific platforms like Authy or Microsoft Authenticator). And as others have said, sometimes you have to verify other details like credit card number and phone numbers too.
Point is username + password should be enough. Go read it again.
So, you're missing the point. This whole procedure is about restoring access in case you lose your username and/or password. It makes sense, and in earlier days of the Internet, the 2FA was your first pet's name.
And that's where you're wrong. Account recovery is inherently broken. Security questions? If you fill them in honestly, the answers could probably be found with a bit of OSINTing if the target has terrible opsec.
Sure, that's why it isn't done anymore. Probably half the darknet population knows my first pet's name by now. But those things have been replaces by TOTP and other measures, and they have worked very well for me, but I still have that phone number and e-mail address from 2001, and a few more for redundancy.
Username-and-password logins have been a problem since they were first conceived. 2FA fixed this for the most part.
Traditional TOTP can be phished. Unfortunately hardware keys are what are required. I hate Authy and Authenticator and think the phishing is unlikely, but IT departments won't budge on it.
A phone number / CC is often required because services will be abused otherwise.
I agree. However much of this data collection is now mandated by law.
Ahhh, the smell of freedom when you lose access everywhere because companies are allowed to treat their customers like crap.
There are certain rules in place that make it easier, but if they're incompetent, they're just incompetent. I had one where I lost a number because the providing service wasn't smart enough to explicitly follow the request- that the losing provider told them (Mostly nationalized now, but not 100% standardized).
Use adblockers to remove them. If their names contain randomized strings, you can try with an asterisk, where possible.
Yeah, I've done that as well as added custom block rules, but some of them used tricks to only render a viewport that is locked when you block the interstitial. If they're that interested in keeping me from reading their site, they've got it.