Is Two-Factor-Authentication compulsory?