Two-factor makes more sense. Relying on your database never getting hacked is nonsense. Is not a matter of are you getting hacked but when are you going to get

Two-factor makes more sense. Relying on your database never getting hacked is nonsense. Is not a matter of are you getting hacked but when are you going to get hacked... expect getting hacked. (disclaimer: I am the founder of Authy.com a two-factor auth API)