Two factor authentication AKA pain in the arse login process

Agree, This would definitely be a more practical solution for we users...and much less of a PITA. I really don't want this.

HSBC and Barclays, the two I use, both require 2FA to log in to your account online.  Use of the mobile app does not require 2FA (as the app is the second factor) but you cannot instigate transfers to new parties via the apps and there is a lengthy process for registering your mobile with the app with Barclays at least.  HSBC required an 8 digit PIN for telephone banking when I registered with them.  Amazon AWS requires 2FA to log in to your hosting account.

If you set up Authy it is simple and easy to use and can be used offline as well - no mobile signal needed, no wifi needed, so you can still even use it to authorise a phone call with our support desk via a land line when you have no other connection.  You can also secure Authy with an additional PIN or touch ID should you wish to further secure your account.

Yes security is a pain - it would be less "bother" if we didn't have passwords and you just typed in your email address or had the computer remember you.  But that's not secure and some accounts have millions of pounds in them.

This current implementation is trying to reach a fair compromise between ease of use and properly securing your accounts.  Even with a nominated bank account there needs to be a process for changing that account, or modifying your password, or selling loan units at a discount to clear out your account, etc.  All these things present a risk to the security of your funds and 2FA reduces that risk.

In time there may be revisions to the dashboard to allow certain low risk operations without logging in, such as checking your balances in the same way as the HSBC phone app allows.

Doesn't Authy work with Chrome on a PC?...Not That I want to use it.

2FA is, obviously, more secure.

However, requiring a phone or mobile device is unnecessary. All the financial sites that I use, that have 2FA, have at least the option is allow you to enter 3 randomly selected alphanumeric characters from your phrase or word.

No one has ever asked me for an 8 digit pin, this is overkill.

I'm thinking more about the motivation for an intruder that would want to access a user account. If they can't benefit financially by emptying out the account and all they can do is cause mischief by moving money around on the platform then it certainly limits the type of attacker that would go to the bother of attempting to gain access. It also limits the possible loss a that we as users could experience should someone actually gain access.

With regard to banks I have used 4 banks in the past few years that have not required 2FA. I suspect that each of these banks has a technical director that has weighed the burden of 2FA for login against the security benefit it provides and decided against it so it's by no means clear cut that it's necessary.

This wasn't a unilateral decision by the CTO, it was a decision made by the exec. The cryptocurrency exchanges I use require 2FA. Amazon hosting requires it. Microsoft Office 365 requires it to sign in. Barclays requires it on my account at least. Should your peer-to-peer lending accounts be less secure?

2FA remains optional to existing lenders for the next two weeks. I'll explore with my compliance officer whether it would be practical to allow lenders to opt-out if they sign a declaration stating they understand the risks or something like that. But I can't make any promises as we need to do the right thing.

While I agree that 2FA increases security, I don't see the necessity for it for each and every login on Assetz.

In my view it would be sufficient to require it for these actions:

 + withdrawals
 + changing any account details (especially the associated bank account and email address)
 + selling loan parts