[FizzyWater]

Originally Posted by eschwartz

Email addresses are something you know, not something you have. Epic fail.

http://en.wikipedia.org/wiki/Multi-f...authentication

2-step != 2-factor

http://en.wikipedia.org/wiki/Two-step_verification


General rant.
Two-step authentication using a single factor means that the person developing the security protocol has missed the whole point altogether.

Google, for example, uses a proper two-factor authentication. You need something you know (username+password) AND something you have (phone).

Um, that's the same thing I do for the Chase login. I do have the option to have it sent to email, if that's my choice, but the choices also include having it go to my cell phone (or home, or work). I can tell it to remember my computer (when I'm at home, for example) or not (when I'm at work, although officially no one else can get on my work computer, I'd still rather not have that cookie saved there).