Years ago, I told them privately of a vulnerability in their implementation of 2FA. They dismissed it as a non-issue. A couple of weeks later they sent out a s

Years ago, I told them privately of a vulnerability in their implementation of 2FA. They dismissed it as a non-issue. A couple of weeks later they sent out a statement "clarifying" how their 2FA had a caveat. It was basically marketing bullshit glossing over the fact that they don't enforce 2FA locally (sorry, details are very vague in my memory now, but I remember it being a serious mis-implementation). Clowns.