[pingyong]

"Really keeping things secure" has a lot of definitions. If your threat model is some guy on the other half of the planet half-heartedly trying out leaked passwords, 2FA is great. If your threat model is someone local specifically targeting you, 2FA kinda sucks, while a good password might do the trick. If your threat model is you getting abducted and hit with a wrench, then you should probably make some sort of shared key with multiple people where you need x% of all parts + invest if physical security.