(1) To set up my 2-factor login, I send you a string of 260 symbols, to be interpreted as a passcard with 10 rows (0-9) and 26 columns (A-Z).
The problem with this method is that if you are sending this information over the internet then it has failed since most trojans record all HTTP traffic