## 2 Related Work and Secure Authentication Mechanisms  
The most popular authentication mechanism relies on the user entering a username/email and password combination in order to gain access to the system. However, if the password becomes compromised, the user might lose access to the system forever. To enhance authentication security and increase account recoverability, many platforms resort to two-factor authentication (2 FA) which is a security measure that aims to provide an additional layer of protection for online accounts and services. The concept of 2 FA involves implementing a multi-factor authentication process, which requires the user to provide two distinct forms of identification. This approach is intended to mitigate the risk of unauthorized access to an account, as it makes it more difficult for an attacker to bypass the authentication process. There are several different types of 2 FA mechanisms, of which we can mention the following:  
SMS-based 2 FA: This type of 2 FA involves sending a one-time code via text to a users' phone number. The user then enters this code to access their account. This method is simple to use but can be vulnerable to SIM-swapping attacks, where an attacker can hijack the users' phone number and intercept the code. A 4-digit code is generated on the server and stored along with the generation date. The code is then sent to the users phone via SMS, and upon entering it into the desired platform, successful authentication is achieved. Time-based one-time passwords (TOTPs): This type of 2 FA uses a software application, such as Google Authenticator or Authy, to generate a new code every 30 s. The user enters this code to access their account. This method is more secure than SMS-based 2 FA because the code is generated on the users' devices and is not transmitted over a network. The users need to have a pre-installed application used to generate codes that follow a pattern. The pattern is synchronized with the server pattern by scanning a QR code generated by the backend server. After logging in with the predefined credentials (username and password), a prompt needs to be filled in with the code generated on the application. Biometric-based 2 FA: This type of 2 FA uses the users' unique physical or behavioral characteristics, such as fingerprint or facial recognition, to verify their identity. Security Key: This type of 2 FA uses a physical device, such as a USB key, that the user must plug into their computer or insert into their phone to access their account. Using two-factor authentication (2 FA) among websites and online services is increasingly relevant in cyber security. The frequency of 2 FA implementation can vary depending on various factors, including the nature of the information being accessed and the industry in which the website or service operates. For example, a study conducted by Google in 2017 found that 2 FA adoption rates had increased over time, with an adoption rate of 15% among all Google accounts. Additionally, a study by Duo Security in 2019 revealed that while a majority (70%) of the top 100 most-visited websites in the United States offered 2 FA, only a tiny percentage (3%) of users had enabled it on their accounts. This highlights the need for further education and awareness surrounding the importance and benefits of 2 FA in protecting personal and sensitive information. There is a trend in dropping the username and password combination and just using a single-factor authentication method to decrease the time required to create an account on a specific platform. Instead of entering the registration information (i.e., email and password) when using the application for the first time, the users are prompted to enter their phone number. Validation of the phone number is achieved by entering the SMS code received. As previously stated, to achieve a faster onboarding and login time, multiple applications or websites have started using authentication based only on the SMS code, without needing a username or password.