Google, Paypal, World of Warcraft, Mailchimp, etc. have all implemented user-facing two-factor auth also. It's the easiest way for them to protect against endpo

Google, Paypal, World of Warcraft, Mailchimp, etc. have all implemented user-facing two-factor auth also. It's the easiest way for them to protect against endpoint insecurity when attackers are going after user credentials en masse. For any other site looking to implement this, check out our open-source web SDKs and service at Duo Security: http://www.duosecurity.com http://www.duosecurity.com https://github.com/duosecurity https://github.com/duosecurity At the very least, we highly recommend folks use it to protect their own cloud/datacenter infrastructure, and have made it free to do so (assuming you have 10 or less admins): http://blog.duosecurity.com/2011/04/ssh-keys-that-call-you-back/ http://blog.duosecurity.com/2011/04/ssh-keys-that-call-you-b... We support callback, SMS, mobile apps for 7 platforms, as well as traditional hardware tokens for online and offline use...