Two-factor authentication, necessary but not sufficient to be safe