I'm not against enabling two-factor on a website that only supports login+password. I use GMail with two-factor, for example. What I'm against is people treati

I'm not against enabling two-factor on a website that only supports login+password. I use GMail with two-factor, for example. What I'm against is people treating "username + password + two-factor" as some high bar of security and usability, suitable even for banking systems (as some users implied before). My point is that we should be looking at other solutions. Two-factor is a stop-gap measure. And please don't call other comments "ridiculous". This is not the kind of community I want to participate in, and probably neither do you. Also note I'm not some crank, this is my area of research.