Yes, proprietary app-based authentication is the worst possible authentication scheme, but thankfully I don't need to use any services that insist on that.