How to use two-factor authentication for critical accounts