Two-step verification can be a PITA but it is the best system right now. I use it for my Apple and Google accounts. When I ran BringSeanHome.org there were constant attempts to hack it from Brazil. I used a service called Duo Security which is a 2 step verification for websites. Set it up to protect the backend software, all hacking attempts ceased.
Perhaps some day soon all our devices will require eye scans - then we'll see people walking down the street holding their phones to their eyes.
No matter with any of this I will never trust any cloud service.