I want to throw companies who force login via emailed timed codes over a bridge. If they only have a username/e-mail field without a password field ready right away, I want to light them on fire. If they offer the option to add TOTP 2FA but still do the previous two, I want to crush them in one of those things for compacting trash. Kickstarter would be a little burning cube falling from a bridge, incidentally.