Don't display them to the user without two-factor authentication then. Everything can be compromised at some point.