An In-Depth Look at Two-factor Authentication