Two-factor authentication is a mess
I&#x27;m looking forward to more genuine MFA. For my site, I&#x27;m experimenting with the ability to identify yourself with as many email address identities as you want (in the future the plan is to add more types including oauth, sms, etc.). If you&#x27;re a regular person, you can just use one. If you&#x27;re cagey, maybe two or three. Straight up paranoid, how about 10?<p>The point is that you are basically using an extensible claims-based approach to identity to create &quot;aggregate identities&quot;. In the case of a beginner user, it just looks like &quot;my account&quot;. More advanced users can add more security as necessary.