You need a security token and unique password.

[sirdayne]

Edited OP to reflect this. I was unaware that method no longer works. The bottom line is getting a security token makes it near impossible for attacks to make it through to your account.

The free version is on iOS and Android.
Physical tokens cost like $10.*

Edit: * As of September 1, 2013, the security token will cost $10.99.