You're wrong that two-factor authentication is a band-aid or that it's trying to solve an easily solvable problem. Not reusing password doesn't provide any prot

You're wrong that two-factor authentication is a band-aid or that it's trying to solve an easily solvable problem. Not reusing password doesn't provide any protection against phishing, which is as big of a threat as the server-side leaks, and for high-value targets, it's even a bigger threat. That said, 2nd factor that's not U2F are not worth it at this point with lots of issues, so indeed U2F is about the only no-compromise (security wise) 2nd factor. All other 2nd factor have serious security or availability downsides.