2-fa legality