Simple OOB authentication is much better than nothing, and I agree with you that most users aren&#x27;t going to buy an U2F key unless it&#x27;s subsidized and&#x2F;or required by a service (look at Github - they&#x27;re running a $5 U2F YubiKey promotion right now).<p>But still, there&#x27;s no way to make this really secure for the average user. IP geolocation is easily tricked - a scammer just needs a large enough botnet and he&#x27;ll be able to pick an IP address in the same city for the majority of victims.