I hate the recommendation of 2FA as the solution. I find 2FA more patronizing than anything else.<p>I use a password manager (1Password) and have a unique, secure password generated for every site. If someone gets access to my passwords, that means they&#x27;ve compromised my 1Password keychain which is game over anyways. I&#x27;m not interested in any protection mechanisms for such an unlikely scenario. So I end up storing the 2FA keys inside of 1Password as well—bringing it back down to 1 factor, but adding annoyance and hassle.<p>Don&#x27;t make assumptions about how your users secure themselves.