It sure seems like multi-factor auth isn't very helpful, when nearly all hacks have nothing to do with breaking credentials.