Phishing and 2factor

I am in receipt of a more or less decently made mail that invites me to go to Cpanel.net to "reconfirm my account." Of course, the link does not go there, but to - Removed - (redacted to defang link.)

This reminds me: When does Cpanel finally get 2factor auth? With it, even a successful phish would be out of water.

I don';t know what is taking so long to enable 2factor. Cpanel clearly is under attack, and passworded Cpanel sites are very weak links in a big chain. I get 2factor for free with Webmin and sundry other products. Is it too much to ask to request this feature for something for which I am paying no insignificant amounts for two servers?

 

I did read the post many times, and voted in the affirmative. This request is more than a year old. It received a lukewarm welcome, and I am getting the impression that it is being ignored studiously. Will it need a huge disaster for it to be taken seriously? This shouldn't take longer than a week to implement. 1 day of coding, and six days of testing.

Please let your customers know what is holding you back, or why you don't want this glaringly missing feature.