> Blockchain.info is a great service, but only when you enable 2-factor authentication (otherwise your encrypted wallet can be bruteforced offline) and make sure you get backups by email.

2-factor auth does not and cannot protect against offline bruteforcing, quite the contrary, it's only relevant for online authentication with a service provider.

In your example it would be for authenticating with blockchain.info so they could perform an action on your behalf. Assuming they use your actual password as a master key to unlock a wallet they store on your behalf, the 2-factor piece is just extra security they are providing for actions performed through their site. 2-factor auth does nothing to prevent someone from trying to brute force the private key or pass phrase for your wallet.

I'm all for using 2-factor auth (I personally have it enabled on every site/service that supports it) but it's only for securing online access to an external service.