When Github feels your PW is compromised, they will keep requiring some 2FA for you to be able to use the service. They will keep insisting you to change your PW
HSBC requires passhrase to login, along with asking certain characters of your 'password' to be inputted before you can login.