Two-factor authentication: how it rescues your accounts

Two-factor authentication gives a thief who stole your password a bitter ending: the stolen password fits, yet entry stays closed, because the service asks for confirmation from a device the thief does not have and never will. This simple idea closes the most widespread hacking scenario: automatic login with a login-password pair leaked from another service. What remains is to pick the right second factor for your tasks, enable it without errors and not lose it along with your phone. Let's go in order.

What a factor is

Factors are independent proofs that you are you: what you know, usually a password; what you have, a phone or key; what you are, biometrics. Two-factor begins when two different types get checked. A password plus a secret question is still one type, two pieces of knowledge, and a leak covers both. A password plus a code from a phone gives two honest types: knowledge and possession, and a hacker needs to get both at once.

Comparing second factors

An authenticator app is that very TOTP: one-time codes that live half a minute and get created on the device with no connection at all. SMS is more vulnerable: someone can trick you out of the code and take the number by reissuing the SIM, so bank and mail protection should live on an authenticator or a key. Pushes are convenient but spawned their own attack: the victim gets bombarded with requests until tapping confirm out of fatigue; number matching cures this, where you enter a number from the login screen into the push.

A weak spot common to all codes: real-time phishing can trick you out of them, as a fake page forwards the code to the real site within seconds. Only hardware keys and passkeys fully close this branch: the key answers a request from a specific domain, and it has nothing to say to a fake site. We covered how passkeys work in the article on passwords.

Why "I have nothing to steal" does not work

People turn off the second factor with the argument "nobody needs my account". They do, just not the way it seems: an ordinary person's mail is the recovery key to their bank and shops, a social network holds friends' trust for money requests, and a gaming account is inventory bought over years. Thieves work a conveyor across millions of leaked passwords, with no targeting, and everyone ends up on it. The price of protection is laughable: five extra seconds on login from a new device, since services remember trusted devices and do not ask for a code again.

This applies doubly to work accounts: an employee's access is a door into the company, and corporate services increasingly just require a second factor with no question asked. A home habit saves nerves at work here.

Enabling without losing access

1. Start with mail: it recovers all other accounts, and its protection matters more than a bank's.
2. In security settings, choose an authenticator app: any mature one, even one built into a password manager. Keep SMS as a backup method if the service allows.
3. Save backup codes right away: a printout at home or an entry in a password manager. This is your way in if you lose your phone.
4. Repeat for the bank, main social networks and work services. On important ones, enable a passkey where available.
5. Spend a minute on an audit: the same settings show which devices and login methods are already linked. Remove extra ones.

A small time-saving detail: when you move a code from an app, many services show the secret's QR code once. If you photograph it "for memory", keep the shot in an encrypted place and stay away from a shared gallery with cloud sync: this QR equals the factor itself.

Lost your phone: what next

The standard scenario, if you prepared: install an authenticator on the new phone, log in with backup codes, then relink the factor. Many authenticators can make encrypted backups, so codes move by themselves. If you did not prepare, what remains is recovery through the service's support with an identity check: the procedure is deliberately long, since hijackers use it too. Hence the article's main rule: save backup codes the moment you enable protection, never "later".

Where this is heading

The industry is gradually removing both the password and the separate second step: a passkey combines both factors in one action, with biometrics confirming possession of the device. While the transition goes on, a sensible set looks like this: a password manager, an authenticator for everything important, passkeys where offered and backup codes in a safe place. If an account has already behaved strangely, do not wait: the step-by-step plan is in the article on account hacking, and the earlier the second factor is on, the shorter that plan turns out.