[Epic] Multi-factor Authentication (MFA)

High value apps or those with sensitive personal data **_need_ extra security**.
We need to make time to investigate Multi-factor Authentication (MFA)
https://en.wikipedia.org/wiki/Multi-factor_authentication

## Relevant Reading:

+ Time-Based One Time Password (TOTP) using the algorithm specified in [RFC 6238](https://tools.ietf.org/html/rfc6238)
+ HMAC-based One Time Password (HOTP) using the algorithm specified in [RFC 4226](https://tools.ietf.org/html/rfc4226)
+ Implementing MFA in `JavaScript` by @rajat-sr: https://hackernoon.com/how-to-implement-google-authenticator-two-factor-auth-in-javascript-091wy3vh3

# Todo

+ [ ] Investigate ***Open Source*** solutions
+ [ ] Investigate ***3***^rd **Party** Solutions.
+ https://theappfactor.com/best-two-factor-authentication-apps
+ https://www.codementor.io/slavko/google-two-step-authentication-otp-generation-du1082vho
> **Note**: we would **prefer** not use SMS-based solutions because:
+ A lot of people have SMS messages appear on their "lock screen" so if a person has physical access to the device (_e.g: a rogue employee_) they can access the token without detection!
+ SMS incur a cost without a corresponding security advantage over OTP apps.
+ [ ] Determine if there is a _free_ or _low-cost_ solution that does not compromise on security
+ [ ] If no free/low-cost solution exists, why not? (_is it a technical or intellectual property challenge?_)
+ [ ] Document/Share findings in a **`mfa-research.md`** file.

If you have time + curiosity to help on this, please comment below!