Two-Factor Authentication: Too Little, Too Late (schneier.com)

That's an article from 2005, as someone would have surely pointed out, but I found the topic to be relevant as there is now a trend of companies like Google, Dropbox adopting two-factor auth and the security implications of that.