Thanks for raising the visibility on this, Jeff. If you'd like to protect the rest of your remote access points check out Duo Security. http://www.duosecurity.com Disclaimer: I work for Duo. We provide two-factor authentication as a service. It's free for personal use. The user experience is substantially better than typing a six digit code: one tap to login using our smartphone app (iOS, Android, BlackBerry). We have integrations for all sorts of VPNs, SSH/PAM, Windows RDP, etc. For everything else we have both a Web SDK and REST API. You can sign up and having it running in a few minutes. Clearly Google cares about this stuff. Google Ventures backed Duo a few months ago by leading our Series A.