Wait, you said "turning on two-factor auth everywhere you can." That's the thing, I'm shocked how many places still don't even offer it! My bank has it, but a bunch of other sites I use for bills or shopping just don't have the option. So we're stuck with just the password there. It's like they want to get hacked.