I have read 2FA adds a beneficial layer of security when logging into accounts. However, many organizations often ask me if I would like to trust the device that I am using permanently so I don't have to receive a text on my phone when logging in.
Does trusting a device effectively mean I'm not using 2FA? Or are the security benefits provided by 2fa still present if I trust my device?
No, it won't negate the advantages of 2FA, even if it reduces it a little. Security is only effective if it does not makes the user resort to workarounds, otherwise they won't use the security option. I would not use a 2FA token if it took 5 minutes to arrive, for example.
In this case, remembering the device for a while will not force the user to enter the 2FA token on every request, and will protect the user if his password leaks somehow. An attacker exploiting this perceived weakness would have to compromise the device itself.
And if you value your security, please don't use "token by SMS", "token by phonecall" or anything that uses your phone number to send the token. SIM swap attacks are real, and lots of people are losing access to their accounts because of it.
The second factor here is something you have, namely access to your phone number which receives the code.
Trusting a device is a transfer of what you need to have. Instead of needing to have the phone number, you now need to have the device itself.
As long as a password is still required for login, it is still 2FA including it's benefits. After trusting a device, the second factor is the device itself.
It might be easier to get access to your device than your phone number, or vice-versa easier to access your phone number, but the 2FA mechanism itself is as secure before as it was after trusting the device.
It depends. Yes, it sort of defies the whole purpose of an added layer of Security that 2fa provides. As, in case of a compromise of the "remembered device" somehow (though could be extremely rare or unlikely), ultimately you lose your account access as well.
That said, it would be a bit cumbersome, considering conveniency, to have to go through an extra layer every time you want to access your account from your everyday-use devices.
So, at the end of the day, it's a choice between conveniency and Security. If you're too paranoid and skeptical about your accounts or data, you might have to give up on ease-of-access.
