Just How Random Are Two Factor Authentication Codes? (2018)
wired.com