Two-Factor Authentication

Foundation · 11 min

The logic of the second lock

A password is "something you know", and knowledge can be stolen: by breach, by guessing, by deception. Two-factor authentication adds a second proof to the login: "something you have" — your phone or a key. Now the attacker who obtains your password stops at the door, because the second proof is not in their hands. This simple addition stops the great majority of account takeover attempts on its own. It should be enabled above all on four account types: email, banking, your password manager and your frequently used social accounts. Email again comes first, because — as you saw in the password lesson — the other accounts' recovery door opens onto it.

SMS: better than nothing, but weakest

The most common method is the code sent to your phone by SMS. It is far better than no second factor at all; but it is the weakest of the methods, for two reasons. First, SIM swapping and number porting fraud: an attacker can trick the operator into moving your number onto their card, and your codes start arriving at their phone. Second, SMS codes can be phished in real time: a fake page asks for the code along with your password, and logs into the real site as you. The conclusion: use SMS only where nothing better is offered; where an option exists, step up a rung.

The authenticator app: the strong middle path

Authenticator apps generate six-digit codes on your phone that renew every 30 seconds. The code is computed from a secret key shared when you link the account, plus the clock; it needs neither the internet nor SMS. That design completely removes one of SMS's two weaknesses: an attacker who ports your number gains nothing, because the codes are generated in the app on your device, not on the line. Against phishing it offers partial protection: a code can still be typed into a fake page by hand. Even so, it is markedly safer than SMS, and for most people it should be the standard on important accounts. During setup, be sure to save the backup codes the service gives you; if your phone is lost, those codes keep you from being locked out — the centre of the account recovery lesson.

The hardware key: the strongest link

A hardware security key is a small device plugged into a USB port or tapped against a phone. The secret of its strength: the key speaks not to you but directly to the site, and only when the address matches the genuine one. However flawless a phishing site looks, the key does not recognise it, and the authentication simply does not happen. That is structural immunity to phishing; it rests on mathematics, not on the user's vigilance. So the ranking is settled: SMS < authenticator app < hardware key. For most people the practical balance is an authenticator app on critical accounts; people with high-risk accounts — public figures, crypto asset holders, system administrators — should take the hardware key seriously.