Second step login is no longer optional – but its implementation quality varies dramatically. The future lies in second factors, moving from “something you have” to “something you are + something you are logged into”.