The private key in on your phone. The two factors are: your password, and the private key on your phone. You have to have a phone with the twitter app installed.
And that's a problem if you live in some cities of the so called third world where phones are stolen at the same rate bananas are picked from trees in Congo by monkeys. I don't feel comfortable at all about the "having a phone" part of my authentication process simply because the device can be stolen at any moment. My attorney had 16 phones stolen in the past 5 years. Virtually all the people I know had their phone stolen at least once. And if the idea of regaining access to your account without the phone is "hard" as claimed by Twitter's sec guys... ufff, I won't even bother to install the app thing. I think biometrics is the only security measure that will work in our violent cities here, not only for web services access, but for device usage itself.
Or you know, just don't use a phone... there are plenty of companies offering password management solutions using browser extensions or desktop software.
[1] http://www.cellebrite.com/forensic-solutions/ios-forensics.h... http://www.elcomsoft.com/eift.html
Their 'physical analyzer' doesn't work from the iPhone4S or iPad 2 onwards (under Click here to view all supported iOS devices).
The key is just harder to steal because it is big and is not sent out. But this doesn't seem to have much to do with phones...
The "what you know"-type authentication is literally what you know, not "I don't know it but it's written down on my phone, hang on a sec". You're supposed to be able to provide it without reference to notes (or Post-Its stuck to the bottom of keyboards).
Regarding security, I'd say just the opposite, I'd expect a random PC to be more secure than a random Android phone.