I tend to think busted 2FA implementations must be to blame, but the list of sites where the only way to log in is to reset my password every time I visit them keeps growing.