Keep with a normal password requirement but lose the 2 factor junk. If someone enters their password wrong too many times temporarily lock the account and have the user unlock the account through their email while also advising the user of the attempts. This doesn't fix the issue of bad actors who know a users account name (unless user name and id can be seperate?) - giving the user a headache from having to keep unlocking their account through their email, but it doesn't/shouldn't inconvenience the majority of other users.
I don't want 2 factor junk but am forced to use a form of it without having it enabled. Because twitch doesn't recognize where I am logging in from (and it never should for privacy reasons) - it is likely from having my computer settings to clear cookies and scramble my device id - twitch forces me to log in to my email to get a code from twitch to enter on twitch. Its like entering 3 different passwords and wastes a lot of my time(attempted twitch login, email login, and entering required code)
My feedback is this: I get angry with being forced to do anything more than puting in my normal login information. Fix please.