Our great MFA savior has fallen

The industry sold us Multi-factor authentication as the holy grail of identity security, but we forgot to account for human exhaustion. Now, attackers who already have your stolen credentials simply spam your phone with login approvals until you surrender and click 'yes' to make it stop. This self-inflicted wound affects every optimistic organization that thought a second factor solved all their security sins. If we want to survive this, we must accept that users will always find a way to let hackers in, and we had better start securing our primary credentials with actual diligence instead.