I recommend two-factor authentication all the time. Adding a second checkpoint during sign-in truly increases the difficulty ...