Two-factor is here

You can now protect your mailbox with two-factor authentication.

After your password, sign-in also asks for a 6-digit code from an authenticator app — Aegis, Google Authenticator, 1Password, or any other. You also get ten one-time backup codes in case you lose your phone.

One thing to know: while 2FA is on, IMAP and POP stay off, because mail apps can't ask for a second code. You can turn it on under Settings then Security.