[denzil_correa]

The article on The Verge says

    While there are likely many who could lay claim to an innovation such as two-step, 
    Dotcom's patent — filed under his birth name, Kim Schmitz — appears to hold some water. 
    It claims priority back to 1997, which would make it difficult to invalidate, and has 
    wide coverage. Despite its age, it illustrates the current concept of two-step 
    authentication by detailing how a secondary access code could be sent via pager or SMS.

I'm not sure what to believe. A patent lawyer's opinion on HN would help perhaps?

[jacques_chester]

My point, to summarise:

authentication != authorisation.

From which it follows:

Two-factor authentication != two-factor authorisation.

The patent does not cover authentication, on my reading.