Vulnerabilities in 2FA implementations