> Obviously it's impossible for compromising credentials to have no consequences -- if case, why do you have credentials? For systems that only require a usern

> Obviously it's impossible for compromising credentials to have no consequences -- if case, why do you have credentials? For systems that only require a username and password to log in, someone else obtaining/guessing my credentials would have the consequence of someone being able to access my account. But if there's a second credential I have to enter in addition to the username and password, then someone trying to use the username and password alone would not be able to access the account. Where I work, this second credential is the RSA token along with a PIN. But this could also be accomplished by using a client side TLS certificate on the work provided device or U2F with a work issued Yubi key.