[duskwuff]

Why "ugh"? Introducing a delay makes it much more difficult for an attacker to use 2FA to lock a user out of a compromised account. It's actually a really smart idea.