[Inufu]

If I want to hack your account, it's not enough to steal your password, I also need to steal your smartphone to generate the tokens.

edit: I was referring to the Google Authenticator App, not sending the codes over SMS. That's imho less secure.

[xyzzyz]

You don't have to steal a master password. It's enough to steal an application specific password, and if you do that, you won't need a smartphone to read my mail.