Should you enable two-factor authentication on every account? Here’s which methods are best, which are tolerable, and how recovery codes save you.