Or you could use a password with a token (such as is provided by google authenticator and others) and that is better than any single point security system.
I think Paypal tried the two factor authentication but it just wasn't as seamless as it is with Google and MS.