Should be time-based or counter-based (HOTP/TOTP), and support the Google Authenticator mobile app.