Familiar with the topics: OOB meaning you use two networks to provide 2-factors of authentication, and single sign-on, using a single, coordinated username and password for multiple purposes. I'm trying to get a sense of whether the OOB is all that it is cracked up to be. I've been trying to understand whether OOB can protect a session from snoopers, and am drawing the conclusion that it can't, if a PC and its browser is compromised. For example, if I use 2-factor Authentication for Outlook Web Access and the 2nd factor Authentication method is a phone, and I'm using a PC in an Internet cafe, I might be able to protect my server but not my session, right?

Out of Band is good because it is difficult for the bad guys to have a view into both forms of authentication simultaneously. My username and password passes through the browser on one network and my phone authentication passes through another. How good the badguys possibly have access to both?