That's what I thought. Implementing it without asking for extra info from the user might be troublesome if access to a phone's UDID is restricted (I think it is

That's what I thought. Implementing it without asking for extra info from the user might be troublesome if access to a phone's UDID is restricted (I think it is with Apple now?), and I'd imagine using a QR code as the second factor might be better for people who don't want to give a service their phone number or receive texts from it. That all being said, and as interesting as it is, I'd be more interested in something that could use, say, push notifications (and Android intents specifically, unless there's an iPhone equivalent) as a smooth implementation of some sort of public key authentication.