https://blog.oppedahl.com/with-epct-always-have-at-least-two-kinds-of-2fa/