3 ms·

Yes, but many sites still use it for 2fa. And regardless of 2fa, it's also commonly used in account recovery which is even worse than 2fa.