If I'm understanding you correctly you're confused why only the hardware column is checked--is that right? That's, unfortunately, a common complaint. The columns _should_ correspond to only the second factor, with an assumption that username/password (a "knowledge" factor) is likely the first factor.
Some backstory on that decision: the site originally had columns for each 2fa company/product you could use; e.g., Google Authenticator, Authy, etc. Listing all the options was not scalable as the number of options grew, so twofactorauth.org went with a more abstract classification based on the second factor interaction. A few examples where that matters:
* If you refuse to use an easily misplaced fob then you might avoid sites that only offer hardware 2fa.
* Not everyone can receive SMS, but maybe they can download an app (software) or reuse their hardware token.
* Some people prefer a voice call, so they might choose a bank that allows for 2fa-over-voice.
Hmmm, what are you seeing that's not clickable? I don't use vimium and I can click on the site name, docs links, and tell-them-to-two-factor-via-twitter.
Whoop. Looks like the tiling system is relying on JavaScript instead of <a> tags for links:
We believe the world deserves a simpler, more convenient way to pay, so we created a free, mobile-friendly money transfer service using Square Cash and QR codes.
This was born out of necessity. We never have cash. Why would we? We shop online at Amazon. We pay for food and drinks with credit cards. We settle up with friends using electronic fund transfers. But there are so many times that cash would be handy, like tipping the local band playing at dinner or donating a few dollars to the grassroots organization set up outside the grocery store. As techies, we think the answer is for fundraisers and people working for tips to post a QR code that people can scan to donate. It’s passive like a tip jar, but it scales a lot better.
Some backstory on that decision: the site originally had columns for each 2fa company/product you could use; e.g., Google Authenticator, Authy, etc. Listing all the options was not scalable as the number of options grew, so twofactorauth.org went with a more abstract classification based on the second factor interaction. A few examples where that matters: * If you refuse to use an easily misplaced fob then you might avoid sites that only offer hardware 2fa. * Not everyone can receive SMS, but maybe they can download an app (software) or reuse their hardware token. * Some people prefer a voice call, so they might choose a bank that allows for 2fa-over-voice.
Hope this helps.