Be me

you WILL use paypal. what are you gonna do, use an obscure Any Forums (mossad) approved pay service that is not supported anywhere?
you literally have no other choice. USE paypal, end of discussion.

There is no benefits in limiting the password length. If people want to use long passwords, just let them do.

64-128 is a bit too long because some encryption schemes use less. 24-32 is more reasonable.
For example, bcrypt is often truncated to 72 characters so if your password is longer you are fooling yourself.

2fa has pros and cons. You don't wanna rely on it too much.

Genuine question, since I don't use it. What's the main benefit of paypal?

>Genuine question, since I don't use it. What's the main benefit of paypal?
none. they have insane transaction fees. it's only "benefit" is that it's widely adopted ; you're more likely to find someone agreeing to send you money to paypal (or letting you pay with it) than using some obscure other service.

>There is no benefits in limiting the password length. If people want to use long passwords, just let them do.
It costs money to pay support staff to help retards who choose ridiculous passwords and then forget them.
>2fa has pros and cons. You don't wanna rely on it too much.
If it's a good form of 2FA (ie. not some retarded sms or email based version), then the only con for the user is that it is less convenient.

I've never had to contact support to reset a password on anything from crypto exchanges to hosting services. This is bullshit.

Cool story, but what does that have to do with anything? Your personal experiences were not the discussion.

Considering the amount of different login portals the company I work for hosts for other companies and having never heard that bullshit excuse, it's also the experience of a lot of other people and companies.

>I've never been in a car crash, therefor car crashes are not common
That's how retarded you sound right now

>I work for a road infrastructure company that covers an entire country and this accident has never happened, therefor it's not common
is what I'm actually saying though

Then you are a lying retard. I know for a fact that password resets are common everywhere, from small businesses to large. There's always those retards who have to contact support because they are too dumb to figure out how to use the automated password reset system. I don't care about your "I am God and have seen every support ticket ever filed and this has never happened" LARP.
I've had my time wasted by enough retards of that particular variety to know that you are full of shit.

>It costs money to pay support staff to help retards who choose ridiculous passwords and then forget them.
The kind of person who would use a long password is usually not the same person who easily forget it. When I have to reset the password of my aunts and uncles it's because they have to pick uppercase letters, lowercase letters, numbers and symbols and different services have different requirements, so they end up having different passwords that are not really memorable for them. For these kind of people a passphrase would be more useful. The autistic anons who pick a randomly generated 30 characters long password are gonna remember it, perhaps because they used a password manager or because they are truly autistic.

>If it's a good form of 2FA (ie. not some retarded sms or email based version), then the only con for the user is that it is less convenient.
Less convenient and a pain in the ass if your device is lost, stolen or broken. Of course, you can use the passcodes to recover it but you was the one complaining about "the cost" of resetting forgotten password so think how easy it is to forget where you wrote the passcodes (assuming you ever saved them in the first place). Also yeah, most services use the retarded sms or email-based 2fa.

I once found some industrial control panel, and turned off everything

I wonder if that was real or a honeypot

>pain in the ass if your device is lost, stolen or broken
Then don't keep your private key on a device that can be easily lost, stolen, or broken (ie. a phone). I'm not sure why every retard thinks they have to use Google Authenticator, specifically. There are so many open source programs that do the exact same thing, for a variety of different operating systems and architectures.
>but you was the one complaining about "the cost" of resetting forgotten password
You seem to be conflating issues. My comment in regards to 2FA was in regards to it's inconvenience to the user. As a user, I don't give a fuck about costs to the company.
>Also yeah, most services use the retarded sms or email-based 2fa
Most services are not important and only implement 2fa to harvest your phone number and/or email address. Almost all the important services support more secure 2FA.