I kinda dig the level of detail in Twitter's blog post today on their new 2FA system. Not really qualified to analyze said details, but certainly they're not going for the obscurity approach. https://blog.twitter.com/2013/login-verification-on-twitter-for-iphone-and-android -- @kylemaxwell