> That's like saying MD5 is fine for hashing passwords, because it's better than plaintext. If for whatever reason you can't have anything else, MD5 is obvious

> That's like saying MD5 is fine for hashing passwords, because it's better than plaintext. If for whatever reason you can't have anything else, MD5 is obviously better than plaintext. Not fine, but better. With passwords you don't have external dependencies but with MFA, you do. Things are more complicated and real life is messy.