If you have public-facing SSH daemons running, adding 2FA seems sensible. Google Authenticator essentially turns another computing device (the smartphone) into an ersatz hardware token. While this does increase security, I don&#x27;t like the trend of turning the smartphone into a universal second factor.<p>Alternatively, you could go for a dedicated hardware token such as Yubico&#x27;s FIDO U2F [1] keys [2]. Hardware tokens that use the fledgling FIDO U2F standard can also be used with PAM and SSH as well [3].<p>Two U2F keys (one backup) will cost around $40, and can be used with a growing number of webservices, including GitHub, DropBox, and GMail as well. The small form factor means you can put the key on your (physical, real world) keychain.<p>1: <a href="https:&#x2F;&#x2F;fidoalliance.org&#x2F;specifications&#x2F;overview&#x2F;" rel="nofollow">https:&#x2F;&#x2F;fidoalliance.org&#x2F;specifications&#x2F;overview&#x2F;</a><p>2: <a href="https:&#x2F;&#x2F;www.yubico.com&#x2F;products&#x2F;yubikey-hardware&#x2F;fido-u2f-security-key&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.yubico.com&#x2F;products&#x2F;yubikey-hardware&#x2F;fido-u2f-se...</a><p>3: <a href="https:&#x2F;&#x2F;developers.yubico.com&#x2F;pam-u2f&#x2F;" rel="nofollow">https:&#x2F;&#x2F;developers.yubico.com&#x2F;pam-u2f&#x2F;</a>