> The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine. There isn't a 2FA craze. There is a slow and pai

> The 2FA craze is overblown, for most applications a random password with length 16 would be completely fine. There isn't a 2FA craze. There is a slow and painful acceptance from companies that 2FA is one of the more effective things they can implement. It is slow and painful because the login logic is threaded throughout most organizations. Moreover, it requires changing how all users work, and that always meets a lot of resistance. Despite all that, it is still growing. That is because password stuffing and password stealing are rather effective, and the number 2 cause of most infections (with the leading issue being phishing mails). 2FA, in one stroke, protects against these measures. It means password re-use by your users (which is inevitable) is a much lower risk. It means shoulder-surfing and keylogging are much lower risk. 2FA is one of the most effective security controls.