Lack of two factor auth is quickly becoming a dealbreaker for me for everything. It doesn't matter _how_ good your webapp/SaaS works - if it's relying on just a password to secure my PII (or worse, my proprietary sourcecode or intellectual property) it's fundamentally broken, bordering on useless.
If a software can log your keypresses, it can probably steal your cookies and log in as you from your machine. Cookies stored by browsers are easily readable by processes running as the same user.
It will help when my unique password get exposed through any of the many likely routes that don't give the attacker complete code execution on the servers - SQLi or using XSS to steal admin tokens for example.
