Random web apps are not. Imap pop and smtp don't sanely support mfa, so the insurance industry is slowly killing them off