> since when does u2a protect against back-end breaches? Because if someone steals your DB password, they still won't be able to login to your account. Maybe

> since when does u2a protect against back-end breaches? Because if someone steals your DB password, they still won't be able to login to your account. Maybe they won't have to, if they also stole your data and found a way to decrypt it, but since those are different things, it is plausible that there could be a leak of login information without a leak of data, in which case your two-factor authentication would keep the attackers out of your data.