Mastering Two‑Factor Security at Candyland: A Player’s Guide