For a long time, multi-factor authentication (MFA) — in the way of push notifications, authenticator apps or other secondary steps — was thought to be the answer to the mounting cybersecurity problem.