On: Gmail.com being MITM'd by Iran using this certific...

[a-priori]

If it works, why do all the online banks use two-factor authentication these days?

I don't know about where you are, but even if I show up at my bank branch in person, they do two-factor authentication (card + PIN).

[pointyhat → a-priori]

The card is not enough to authenticate you. It is enough to identify you. Slightly different concepts.

So card = identify. PIN = authenticate. That's not two factor.

The second factor would be an RSA key or a Digipass device.

[tptacek → pointyhat]

You are using the words "authenticate" and "identify" in ways that professionals do not. In reality, a card and a pin are two factors in an authentication system; your fingerprint is a third (biometric) factor which does not need yet another synonym for "identify" to describe; the reputation of your origin IP is a fourth factor, your behavior a fifth.