In design, everything is intentional and I fail to believe these cheap UI tricks were anything other than intended as designed by whoever designed it. Any seasoned UX designer worth their title knows if what they are designing removes their agency in deciding on how to act or if it feels icky or wrong in a manipulative sense.
That's more of a rhetorical point - I don't believe most things related to "morality" can ever be as clear as black/white, ethical/unethical, and think it muddies waters to assert it does.
Considered design does not always exactly equal purer-than-pure ethical design.
Simply put, I would never allow these dark design patterns into the product if I was the designer, by arguing that it would affect perceived trustworthiness of the company and brand credibility if dark patterns start to become pervasive and the norm across the product. As a professional UX designer, it's my duty to be the voice of the user and I'd put my neck on the line to make sure I voiced my concern before they went over my head and implemented dark patterns. I'll never sign off on it.
The issue is a lack of accountability by designers/PMs who hide behind the company name when these dark patterns are exposed. In an era when companies like Facebook sway political elections through their dark pattern designed newsfeeds, watchdog groups and regulatory bodies need to be created to keep them in check.
For example it is entirely plausible that the sms notification being sent once you put in a 2FA number is completely unrelated. In a normalised database there will only be one phone number for multiple uses. If notifications are set to send to the phone number by default and 2fa uses that phone number the app will not necessarily have knowledge whether the phone number was entered due to a 2fa prompt or something else. It only checks for a phone number and acts accordingly. The 2 people/teams who designed each feature would most probably have no idea how else the number is being used such is the nature of complexity.
No! Normalization does not mean keeping only one copy of each piece of data, regardless of category and context. I see this behavior all the time in junior and even some senior devs, both in databases, and when they code.
A piece of information has a type, but it also has a context. A 2FA phone number is different than a marketing contact phone number. It should never be normalized into just one field.
My favorite example of this is people re-using a constant in multiple places in code just because it happens to have the same value. Imagine you have a constant defined as `USER_DISPLAY_AS = 'first_name'`. Then, somewhere, you are building sorting and want to be able to sort by first name or last name. You notice you already have a constant that contains a value 'first_name', so you use it. Not you have tied two completely different things together in your code because you thought you are being DRY.
I shall dub it "Krystian's Overoptimistic Denormalization Error", or KODE for short.
No matter which metrics you choose, you run the risk of PM's ordering unethical means of increasing those metrics. A bakery can measure itself by sales volume and ensuing revenue numbers - that doesn't by itself prevent bakery managers from adding addictive drugs to the recipes, nor does it mean that those are poor metrics.
What it does mean is a) the company made some poor hiring decisions along the way, and the best way to deal with that problem is by having some b) ethical review board.
I am an American but I am well accustomed to learning that other countries are able to prevent certain consumer abuse before it replicates at massive scale by acting early and adjusting along the way.
Does this happen in Europe?
Abusing the 2FA number is likely illegal in most member states now, and is definitely so at the end of May.