It baffles me that we all services haven't defaulted to something like Google Authenticator or similar. Users should be given a choice.