We Got Phished
2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it!For everyone else, I think the new 2fa Google App approach is better.  When you go to login, your Google App pushes a notification to your phone and you have to click on it.  This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of attacks for now, it's worth it!