2.31 Protects against username & password disclosure

Verify that if an application allows users to authenticate, they can authenticate using two-factor authentication or other strong authentication, or any similar scheme that provides protection against username + password disclosure.

Levels: 2, 3