The hard part of multi-factor authentication has almost nothing to do with technology. How to make the friction small enough that nobody bothers to fight it.