What Is Two-Factor Authentication (2FA)?

TL;DR

• Two-factor authentication (2FA), also called multi-factor authentication (MFA) or two-step verification, asks for a second proof of identity on top of your password, so a stolen password alone is not enough [2].
• Security keys and passkeys are the strongest options, authenticator apps are a solid middle, and text message codes are the weakest [1].
• Any second step is better than none, so turn it on for email, banking and shopping first.
• Keep backup codes somewhere safe so you do not lock yourself out.

The three kinds of proof #

Logging in with only a password relies on one thing: something you know. Passwords get stolen in data breaches, guessed, reused across sites or typed into scam pages, and a strong password is no harder to steal than a weak one [3]. 2FA fixes this by adding a second, different kind of proof [2]:

• Something you know, such as a password or PIN.
• Something you have, such as your phone, an authenticator app or a physical key.
• Something you are, such as a fingerprint or face scan.

Think of a bank card: the card is something you have, and the PIN is something you know. Losing one does not give a thief the other.

SMS, apps and security keys compared #

The big difference is phishing. Codes from apps and texts can be captured by a fake login page and passed to the real site in real time. Security keys and passkeys only work for the real site they were registered with, so a lookalike page gets nothing [1]. CISA calls this kind of method "phishing-resistant" and says it is the standard to aim for, while stressing that any MFA is better than none [2].

Avoiding lockouts #

Because 2FA depends on a device, losing the phone or changing your number can lock you out. Many services give you one-time backup codes: store them securely and make a new set after you use some [1]. Some authenticator apps can back up their codes, so check that the backup is end-to-end encrypted. Registering a second key or device is also a good idea.

2FA does not replace a strong, unique password. Keep using a password manager as well [1].

Where to turn it on first #

Start with the accounts that can reset others: your email, then banking, social media and online shopping [2][3]. Look in the account's security settings for "two-factor", "two-step verification" or "multi-factor".

FAQ #

Is two-factor authentication the same as two-step verification? #

In everyday use, yes. 2FA, 2SV and MFA all describe asking for more than a password. MFA is the general term, since some systems ask for more than two proofs [2][3].

Is SMS 2FA still worth using? #

Yes. It is the weakest common option, but it still stops many attacks that rely on a stolen password alone. If a service offers an app or security key, choose that instead [1].

What happens if I lose my phone? #

Use a backup code or a second registered device or key to get back in, then remove the lost device from your account. This is why saving backup codes when you set up 2FA matters [1].

Do I still need a strong password? #

Yes. 2FA is an extra layer, not a substitute, so keep passwords unique and long [1].

Sources #