I have online accounts with many financial institutions and I do most ofmy transactions online. Being a security conscious user, I take all precautionsfor using strong and different passwords along with managing my passwords in asecure way. But frankly, all these are too much complicated. The fear ofmis-managing the passwords and possibility of your bank account being pilferedremains.

Password based authentication is past its use-by-date. With the current advancesin technology and skills, password authentication is like providing passbook tothe person who mentions the account number (an unsophisticated but a real lifeexample in non urban banking in India till couple of years back). I am notgoing into the details of how a password can be cracked or known by others. Themain problem is that once password is known, the intruder's job is done and hehas uninterrupted access.

Two-factor authentication alleviates this adding one more factor forauthentication. Along with password (which you know), you need to provideinformation based on what you have. One of my bank has given me security tokenwhich generates an unique number every time I press a key. I need to enter thisnumber along with password for authentication. So even if my password iscompromised, an intruder cannot login as he does not have this token and cannotspecify the unique number. Of-course there are various other ways to providethe second factor in authentication based on what you have (software basedtoken, phone, cell phone). Again the advantages are same.

Note that two-factor authentication is not solution for ‘Man-In-Middle’ orTrojan attacks. Both of these attacks will not need your the input passwords orunique numbers. These attacks which take place with the help of phishingare more active threats to be worried about. But that is a topic for anotherpost.  

In summary, by using two-factor authentication, we are juststrengthening the already existing security mechanism against a known threatand not really dealing with any new threats. So in that way two-factorauthentication has become a first step in any security implementation.