Consider such two factor authentication on web site: say when user enters username/password on web site - and receives SMS on mobile phone number. For attacker to access this he must know your username/password - and also steal your mobile phone.
But if I want to protect mobile phone application this way, I think the second factor is not useful anymore. Because in order for attacker to access your mobile phone application, she has to steal the phone anyway - now if she stole it AND knows user name and password he can access your mobile phone app.
So I think the two factor authentication scheme I described above doesn't bring much security when used for mobile phone application; Of course that is not the case if you use this method for authenticating with web site. Am I right?
So what second factor is typically used to protect mobile phone applications? (besides password).