Loads of people think 2FA solves more than just mass password spraying. How the hell did we get here?