Yeah that's a fair criticism. It is on the todo list to add some other auth factors.