@psf@oldbytes.space but that doesn't change my original point - an attacker who has a vendor's password database and nothing else gains access to nothing if all users are using 2FA, and potentially everything if they're not. I understand your argument that this is still the vendor's responsibility, but the same applies to phishing resilience.