He's just saying that there's an extra authentication step. Which wouldn't do him jack-all if he had a keylogger on his computer.