So this is only relevant to websites that do not use passwords and only do a temporary one time code... this is not 2FA correct?