their gmail account years ago. Nor will they have a cell phone with a GPS that's constantly broadcasting their location like a little tracking device. Secondly, they'll probably run their own mail server, and have a nice long 20 char password, and some nice strict logging / banning policies. Thirdly, anything they send over the wire that's important will be encrypted. Any of the above would have been boring boilerplate we already knew, but it still would have been better advice to your readers than to hand your cell phone and/or personal details over to Google. Seriously, if having your gmail account compromised would cause you to lose control of your bank account, then your problems are not going to be solved by two-factor authentication. You need to rethink your approach to personal security entirely. However, can you explain to me why it's better than using a strong password? Let's say: - My password for my email is $p+p9Dv5"L][&Y#Oq&gt;$E (hint: it's not, but it's _like_ that) - Each password I use is different and I store them in a secure password manager (it sounds like in your anecdote the person used the same insecure password everywhere, and hackers got it through some random forum hack or something) - I don't use password hints (one way to disable them would be to put massive random strings) - I don't give out my password over the net, or install malware etc Where is the danger? In terms of insecurity, I think the