Time and again we write about security breaches that would have been prevented by two-factor authentication. What are the ways people do this in the real world?