In reply to Isaac Naor.

Multi-factor authentication is definitely required, but I think a shift from a 1 bit authorized/unauthorized flag to a 'confidence level' would be a nice step both for service providers and BYOD. Something you have, plus something you know is pretty secure, but can be defeated in some cases. Adding some location checks to that combination adds confidence.

You also could 'norm' the confidence. For example, Isaac Naor connects often from multiple devices, but within a particular large geofenced area. Suddenly he has an IP commonly associated with Romania and it appears to be a new device ID. Flag him for re-authentication (on all accounts). Oh, he was on vacation and lost his phone during the flight and this is a new one.

To directly answer your question, until the network and applications get smarter, userid/password/[sms|authenticator token(rsa/google)] are nice multi-factor ways to keep your accounts more secure. Someone needs your user, password, and some device you have. If they have all this, you must be a very interesting person :)