How Multi-factor Authentication Protects Private Data