2FA is the solution, at least right now. https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html