ES EN

PasswordSecure.org

Two-factor authentication: the second lock

Which method to choose, where to start, and where its limit is.

Published Who we are

Two-factor authentication is, by a distance, the security measure that pays back the most per minute invested. The idea is simple: even if someone has your password, it is useless without a second element only you hold. It is what turns a breach into an annoying notice rather than a lost account.

You will see it under many names — 2FA, MFA, two-factor authentication, two-step verification — and they all mean the same thing: something you know (the password) plus something you have (a phone, a key).

The methods, worst to best

SMS: the weakest, and still far better than nothing

You receive a code by text message. It has two real problems. The first is SIM swapping: someone convinces your carrier to move your number to another SIM and starts receiving your codes. The second is that messages show up on your phone's lock screen.

That said: if your bank only offers SMS, turn it on. The right comparison is not SMS versus a hardware key, it is SMS versus nothing.

Code apps (TOTP): the sweet spot

An app such as Aegis, Ente Auth, 2FAS or the one built into your password manager generates a six-digit code that changes every 30 seconds. The code is computed on the device itself from a shared secret, so it never travels over the network and does not depend on your carrier or on having signal.

For almost everyone this is the right balance of security and convenience. If you only change one thing after reading this, make it moving your main email from SMS to a TOTP app.

Security keys and passkeys: the strongest

A hardware key (YubiKey, Nitrokey) or a passkey stored on your phone or computer uses public-key cryptography and, crucially, checks the domain. That is what makes them special: they are the only method that resists phishing. If the site asking you to authenticate is not exactly the real one, the key does not respond. There is no code to copy, and therefore no code anyone can talk you out of.

Backup codes are not optional

When you turn on two-factor authentication, almost every service shows you a list of single-use codes. This is the moment most people tap "later", and it is an expensive mistake: losing your phone without those codes can mean losing the account for good. Store them somewhere you can reach even if the phone disappears: printed in a drawer, in a secure note in your password manager, or both.

The other precaution that saves grief: when you register a hardware key, register two, and keep the spare somewhere else.

Where to start

You do not have to enable it everywhere on the same day. This order covers what matters in under half an hour:

  1. Your main email. It is the master key to everything else: any other account can be reset from there.
  2. Your password manager. Everything you do not memorise lives inside it.
  3. Your bank and payment methods. Here the damage is direct and immediate.
  4. Your phone and platform account (Google, Apple, Microsoft), which syncs passwords and devices.
  5. Social media and the rest, at your own pace.

What it does not protect against

It is worth knowing where the limit is, because a half-understood layer of security gives false comfort:

  • Real-time phishing. A fake site can ask for your password and your code at once and use both immediately. TOTP codes and SMS fall to this; passkeys and hardware keys do not.
  • Sessions already signed in. Malware that steals your browser's session cookie walks straight past the second step, because as far as the server is concerned that session is already authenticated.
  • Prompt fatigue. If you use "is this you?" push approvals, someone can fire dozens of them until you accept one out of reflex. Faced with a prompt you did not trigger, the right answer is to deny it and change the password.

You still need a good password

The second factor is reinforcement, not a replacement. A weak password with 2FA is still a half-protected account, especially if that password is reused on other sites with no second step. Generate every one at random, memorise only the essential ones with a passphrase, and review the ones you already use in the checker.

Sources