"I agree but" ;) With a little head scratching, there are excellent solutions. In Luxembourg, I had a little hard-printed card with 52 letters. At each login t

"I agree but" ;) With a little head scratching, there are excellent solutions. In Luxembourg, I had a little hard-printed card with 52 letters. At each login to my bank, I would be asked for 3 of them, plus my password. With this kind of extremely-cheap-and-portable token, I would dare to login even from an untrusted country. Because I never have to type the full 52 letters. That's only for email. Every other service relies on email security. The problem is, it's the provider (fb, gmail, ...) who chooses how their authenticate you. I wish a system like Mozilla Persona would gain traction (looking at you Gmail), because it would trigger innovation. There are a lot of better alternatives to passwords and SMS for 2FAs.