“Two-factor authentication isn't our savior. It won't defend against
phishing. It's not going to prevent identity theft. It's not going to
secure online accounts from fraudulent transactions. It solves the
security problems we had 10 years ago, not the security problems
we have today.”

Bruce Schneier

src=Advanced Penetration Testing - Will Allsopp , Wiley 2017