[mgurlitz]

Chances are the only ones who will try this are your users already using two-factor auth somewhere else, and it's most likely they got started with Google. Might as well use an app that's already on their phones, Google Authenticator (http://news.ycombinator.com/item?id=4348475)

[jonknee]

Who says it's optional? I make primarily B2B web apps, it's very easy to require all users begin using two factor auth.