It's pretty easy to implement your own TOTP client if you don't like any of those. Here's a JS reference in 250 lines of code and HTML: https://code.google.com/p/google-authenticator/source/browse...
In MePIN's defense, DuoSecurity also has their own push notification for a single-tap login, so users are willing to trade interoperability for convenience.
> MePIN comes as a distributed hosted service containing simple-to-use REST API and handy client side scripts. Hosted or in-house white label solution is also possible, contact sales@meontrust.com.
"What happens if/when these fellas implode?"
The answer in the site's case would be to fall back to SMS. Something like this that could be integrated into the site itself would be better, working in tandem with a more typical fall-back of course.
Other than that; You own your users and user database. No user data is stored at MePIN servers.
Users are going to essentially ignore ip address. OS, web browser, and location are easy to spoof. If a half competent attacker makes a request, how is the user to know if they should authorize a request.
I understand that using OTP codes can be annoying to some users, but it is MUCH harder for a user to hand that code over to someone in order to login.
Authorization requests can only be initiated at the back-end by authorized service providers and only for users who have linked their MePIN app with that specific provider. Though of course login verification could be initiated with stolen username/password, which would then alert the user for verification.
Now the added benefit here is that with MePIN the user would immediately know that her username and password is at wrong hands if she receives a login verification request while not actually performing a login.
So obviously the user should not authorize unexpected requests. You would not authorize a login if you are not actually performing a login, etc. Concerned users can additionally set up a personal PIN code in the app.
Lack of good usability is currently hampering 2FA adoption, we are working hard to fix that.
With the standard OTP model, a user physically can not enter their code for another user.
