Long story short, I'm not particularly concerned about an attacker stealing my password when I log in to a website. I don't usually log in on untrusted networks, and when I do I make a point of double-checking SSL certificates. I never keep my passwords on my computer. I always log out of websites on my laptop, which is the only computer that leaves my home. And so on.
So the only real way I can see an attacker gaining access to an online account is by either:
- Brute-forcing my password through a login page.
- Getting access to a password database from the targeted website.
In the former case, I understand how 2FA will protect me. But will it protect me in the latter case? Similarly, what about public key authentication (not 2FA, but there's no password to leak)?