You're doing two-factor authentication wrong because of not allowing me to use a single factor only (maybe I do not want to check e-mail and/or to carry smartphone with me and/or your website has too miserable value to me to take care about it).
I guess if you're some sort of public figure it might be, but selling blue badges to anyone kinda destroyed any credibility it had as a platform for those people.
But they have a "Skip" button which so far works just fine. And I'm very happy it's there. So regardless of other merits, at least Ubisoft did that right with UPlay.
But the biggest security flaw, it turns out, is systemic, not individual: people simply don’t care about securing their one measly vote as much as they care about securing $100,000 in their bank.
So while people were motivated to secure large individual balances, they were not motivated to secure their votes.
Which is why we have to force people to confirm their votes on another device, so that Apple or Google couldn’t theoretically steal the election by lying to you about who you voted for, let alone some random website like stackoverflow (which people trust in their moderator elections etc.)
It turns out that this is also necessary for Web3 — the current state of security is dismal, the vast majority of people don’t actually check they are interfacing with the right contract or calling the right method or sending the right parameters before they hit “Submit” to sign the transaction. So even there, people have to be forced to double-check the details on another device, depending on the value of the transaction.
For more info see my article from 2020: https://www.coindesk.com/tech/2020/03/12/in-defense-of-block...
Polygon is probably going to be the winning provider of the space: https://community.intercoin.app/t/polygon-overtakes-ethereum... (although there are smaller ones, such as Arbitrum, Cardano)
I imagine that, in the future, we will simply have an "embarrassingly parallel" set of append-only logs, which is already possible with projects like Hypercore. And we will run consensus with those.
As for your question - the way you have secret voting is by using ring signatures. (Monero has ring signatures.) You just have to indicate that you're part of a group, and that you used your one vote, but it doesn't say who you are https://en.wikipedia.org/wiki/Ring_signature
This was known since 2004, and doesn't require blockchains in fact: https://eprint.iacr.org/2004/281.pdf
A blockchain-based way would be to use a mixer (like Tornado Cash does) to mix up the tokens so each person still has exactly 1 but now it's harder to trace who has which one.
Previously you had only the login and the password. Now, you need a phone and likely probably an app on the phone.
This whole push for 2FA is actually a push against individual password managers where users generate long cryptographically secure passwords.
In my opinion, learning to use a password manager has effectively eliminated dozens if not hundreds of passwords and user names that I would have had to remember and all I need to remember is my one password manager password and everything gets copied and pasted in automatically. Even easier on my phone with FaceID unlocking the vault.
But it is still a complication and disruption to previous sign in flows that I had to adapt to and maintain.
Generating passwords properly gets rid of need of any password manager while each password keeps being unique. It is useful if most of my devices for internets don't have any password manager implemented (example - any Blackberry/Symbian/Opera Mini)
Twitter is about there for me. If someone took over my account, Meh. I'd just create a new one. It's not tied to a real email anyway. I actually think I'm on my 3rd one now. Because I forgot which email I used to sign up.
But I also hate to add a password for each shitty website. I also don't want to connect an account via e.g. OIDC with any of my important accounts. I think there is a product or at least a new common mechanic somewhere in this mess.
Unless you only access that site via public infrastructure like a library, but that might not be infrastructure that you want confidential information to run over, because everybody and the milkman has access to it. And even then, 1Password for example also has an online version that you can access in those cases.
A paasword manager is also "your brain". A website can be happy with just a password.
For crying out loud, people don't need 2fa for a knitting forum!
No, it isn't a crisis if someone gets my credentials to the knitting forum, the pics of acrons forum, and the local 'reserve space at the county pool' website... all in one go.
I can just change them all at once, from the letter 'a' to the letter 'b'.
I've set the bar pretty low these days for "if you require a login, I go somewhere else" because there are plenty of places that just don't need it in my opinion.
To be honest, I class Twitter as one of those places; I go there to read certain information from specific "outlets" but Twitter as we all know have made it very difficult (as with other social sites of this type) to be read-only.
I dispute that. Does the Nintendo Switch have a password manager?
My point from the root of this tree was that I do not want to make a shit travel (github asks me to prove identiny by mail > gmail asks me to prove my identity by phone > my phone is somewhere else because I am not addicted to it) just to have an ability to use my github from web-interface. If I can successfully use my bitcoins without any 2fa/totp security theater than github is just shitting me with no good reason for me and for my helloworlds collection.
Probably just saving cookies solves the problem of the shit travel, but since every few hours session of browsing makes me to store tens megabytes of cookies with no value to me (except of not un-logging from github) I use to clear all cookies every time I close my browser.