exactly, I'm paying a lot for working two-factor authentication. If the algorithm generating one factor is known by hackers, and I simply have 2 passwords which the user could have written down somewhere or picked the most obvious or gotten keylogged, then what am I paying for?