Two-Factor Authentication: SMS, Apps and Security Keys

Even with strong unique passwords, an attacker can sometimes obtain one, through phishing or a data breach. Two-factor authentication, often written 2FA, makes that stolen password almost useless on its own. In this lesson you will learn what the "factors" are, compare the three main methods with their strengths and weaknesses, and decide which one to use where.

In the last two lessons you protected your accounts with strong passwords stored in a manager. Now we add a second, independent lock. The idea is the same as at a bank: to withdraw cash you need both your card (something you have) and your PIN (something you know).

The three kinds of factors

Authentication means proving that you are who you claim to be. Security specialists describe three families of evidence:

• Something you know: a password, a PIN, an answer.
• Something you have: your phone, a physical key, a bank card.
• Something you are: a fingerprint, a face, an iris.

Two-factor authentication requires evidence from two different families. Two passwords are not two factors, since both are things you know. When more than two factors or more than one second step are used, we speak of multi-factor authentication (MFA).

The reasoning is simple. To break in, the attacker must now steal both your password and the second factor. The password may be stolen far away over the internet, but the second factor (your phone or key) usually is not.

Method 1: codes by text message (SMS)

The service sends a six-digit code to your phone number, and you type it in.

Advantages: available almost everywhere, needs no app, easy to understand.

Limits:

• SIM swapping: a criminal convinces your mobile operator to transfer your number to a SIM card they control, and then receives your codes. It is less common but serious for high-value targets.
• Interception and redirection: text messages are not designed for strong security, and some attacks exploit weaknesses in the phone network.
• Phishing: a fake page asks for the password and then for the code you just received, and forwards both immediately to the real site.
• Dependence on a network: no signal, no code, which is a problem when traveling.

Verdict: much better than nothing, and a good choice when it is the only option offered. Use something stronger when possible.

Method 2: authenticator apps

An authenticator app generates a new six-digit code every 30 seconds, based on a secret shared with the service when you set it up, which is usually done by scanning a QR code. This is called a time-based one-time password (TOTP).

Advantages: works without a network, is not tied to your phone number and so is not exposed to SIM swapping, and is free.

Limits:

• If you lose or replace your phone without a backup, you can lose access to your accounts. Store the recovery codes offered at setup.
• It is still possible to be phished: if you type the code into a fake page, the attacker can use it within its short validity window.

Some apps and password managers allow encrypted backup of the codes, which solves the lost-phone problem. There is a trade-off, though: keeping passwords and codes in the same vault means that someone who breaks into the vault gets both factors. For your most critical accounts, such as email and the password manager itself, keep the second factor separate.

Method 3: push notifications

Some services send a notification asking "Is it you? Approve or deny". It is simple, but it suffers from "MFA fatigue": an attacker who has your password triggers dozens of requests, hoping that you will tap "Approve" just to make them stop, or by mistake at night. The rule is simple: never approve a request you did not initiate, and change your password immediately if you receive an unexpected one, because it means someone has it.

Method 4: physical security keys

A security key is a small device, plugged into a port or tapped against your phone, that you touch to confirm a login. It is based on a modern standard (FIDO2, covered in the next lesson).

Advantages: it is the most resistant to phishing, because the key checks the website's real address and will simply refuse to work on a fake one. There are no codes to type or intercept.

Limits: it costs a little money, can be lost, and not every service supports it. Buy two, keep one in a safe place as a spare, and register both.

Comparing the methods

Method	Convenience	Phishing resistance	Main weakness
SMS code	Very high	Low	SIM swapping, interception
Authenticator app	High	Medium	Lost phone without backup
Push approval	Very high	Low to medium	MFA fatigue, accidental approval
Physical security key	Medium	Very high	Cost, loss (buy a spare)

The ranking in terms of security, from best to worst, is generally: security key (or passkey), authenticator app, push approval, SMS. But any second factor is far better than none.

Where to enable it first

Start with the accounts that can hurt you the most or that can unlock others:

1. Your main email account.
2. Your password manager.
3. Banking and payment accounts.
4. Cloud storage and the account tied to your phone.
5. Social media, which are often taken over to scam your contacts.
6. Any account at work, following your organization's rules.

Recovery: the step everyone forgets

When you enable 2FA, the service usually offers backup codes: a list of one-time codes to use if you lose your second factor. Print them or store them in a secure place, such as your password manager's secure notes (for non-critical accounts) or a locked drawer. Without them, a lost phone can turn into a lost account.

Your turn

Exercise. Enable two-factor authentication on your main email account and on your password manager. Choose the strongest method each one offers, and save the recovery codes.

See a solution

1. Open the security or "sign-in" settings of the account. Look for "two-step verification", "2FA" or "multi-factor authentication".
2. Choose, in order of preference: a security key or passkey, an authenticator app, then SMS. If you pick an app, scan the QR code that the service displays and then type the six-digit code to confirm.
3. Download or write down the backup codes. Store them away from the device (a paper copy in a drawer is fine).
4. Test it: sign out, sign back in and verify that the second step is requested. Check that you can still read your recovery information.

If your email provider offers several options, replace SMS with an app as soon as you are comfortable, and keep the phone number as a recovery option only.

Add to your Security Notebook

Under "2. Accounts and passwords", build a small table: for your five most critical accounts, which second factor is enabled and where the backup codes are stored. Mark the ones that still use SMS, as upgrade candidates.

The last lesson of this chapter looks at the future of logging in: biometrics, security keys and passkeys.