Gizmodo has a handy guide to enabling two-factor authentication on your accounts with Apple, Google, Microsoft, Twitter, Dropbox, etc.
Two-step, or two-factor authentication protects your accounts by requiring you to provide an additional piece of information after you give your password to get into your account. In the most common implementation, after correctly entering your password, an online service will send you a text message with a unique string of numbers that you'll need to punch in to get access to your account.
The idea is that you're drastically more secure if somebody needs both your password and the physical phone to get access to your accounts. Add a passcode to your phone, and you're safeguarded against someone stealing both.
Is it perfect? No. But it's way better than just irrationally hoping nobody ever gets a hold of your password.
