That's right choice, two step authentication is a bit hard one, here email is not a mandatory one. so most of the user accounts not created with email accounts, and also SMS requires SMS gateway for securing the login. So its bit typical this way. Google Recaptcha is good way to prevent hacking tries. But it has to be programmed inside session file to handle the login and its google captcha validation.
]]>