If they stored my password in plain text, I'm not sure I would trust their 2FA implementation to actually function as a second factor to protect my account. :)

If they stored my password in plain text, I'm not sure I would trust their 2FA implementation to actually function as a second factor to protect my account. :) Seriously though, isn't this a little like saying that a website could have two passwords on each account so if they suffer a data leak that happens to leak only one of your passwords, that wouldn't be enough to access your account?