MFA was supposed to be a virtual panacea. For a while, it worked well. But attackers found a reliable workaround