I actually pull out all my funds when Bitfinex required me to use google auth or Bitgo as and 'extra measure' of security. I found my self having to confirm things 6 times - then use google.
To me? If someone has access to my email and can read the texts confirmations that com in on my sip account, then they deserve my Bitfinex withdrawal. Ether way. I got out before hand on MtGox, Bitstamp and Bitfinex.