"For those who wish, would it not be a good idea to allow/require the use of some second factor?" The first 16 characters are your first factor, the second 16 characters are your second factor. The big question is whether the program uses a cryptographically strong random number generator. I don't know the answer to that.