And worse (sometimes) consumed by email scanners. There's all sorts of hassles with them. Email deliverability often an issue too.

Oh, I see. Thanks! So, they're basically the second part of 2FA?