I'd always felt that combining a password with another authentication method was everything I needed. If an attacker steals ...