I made a wallet at blockchain.info and enabled two-step authentication using Google Authenticator.
As I understand it, the operator of blockchain.info cannot access your wallet (unlike e.g. MtGox). Yet somehow blockchain.info can deposit coins in my wallet.
Also, I assume the two-step does not work for the offline backup files, but the password does?