Why no 2-factor authentication for web apps?
cperciva: Some banks -- mostly in Europe -- have started using two-factor authentication.  But so far the biggest problem with "something you know and something you have" is an unavoidable one: "something you have" costs money.