A New Perspective on Two-factor Authentication