This 2nd element is strictly bond to something that the person has (similar to a mobile), and that identifies him. The 2-variable authentication can Therefore be considered as a list of a thing that is known (password) https://im-token-io.com/pbaxg/