Two-factor authentication explained, and which kind to use

Someone tells you to “turn on two-factor authentication”. You do it for your email, then wonder whether the text message code you now get is really enough, and whether the other options are worth the bother.

Short answer: any second step is much better than none, and some kinds are stronger than others. This guide explains what two-factor authentication is, the main kinds, and which one to pick for each account.

What two-factor authentication means

Two-factor authentication, often shortened to 2FA, means you prove who you are in two different ways when you log in. The first is your password, something you know. The second is something you have, such as your phone, or something you are, such as your fingerprint.

The wider name is multifactor authentication (MFA), which allows two or more steps. People use the two names almost interchangeably. The US Cybersecurity and Infrastructure Security Agency (CISA) describes it as a layered approach where a system requires a combination of two or more credentials to verify your identity.

The point is simple. Passwords get stolen, guessed, reused and leaked. CISA says that even if you have a complex password, bad actors still have ways of getting past it. With a second step in place, a stolen password on its own is no longer enough to get in. CISA puts a number on the benefit: using MFA makes you 99% less likely to be hacked.

The main kinds, from weakest to strongest

Not every second step gives the same protection. CISA is direct about this: some types are better than others, and the best standard is phishing-resistant MFA, but any MFA is better than no MFA.

1. A code sent by text message (SMS) or voice call. This is the most common and the easiest to set up. You log in, a code arrives on your phone, you type it in. It is the weakest of the usual options, because the code can be tricked out of you on a fake login page, and a phone number can be targeted. But it still stops a thief who only has your password. If it is the only option an account offers, switch it on.

2. A code from an authenticator app. An app on your phone shows a six digit code that changes every few seconds. It does not depend on your phone number or on a text message arriving, and it works without a signal. It is a solid step up from text messages. Its weakness is the same as above: if you type the code into a convincing fake page, the thief can use it straight away.

3. A prompt on your phone with a number to match. Some services send a “Is this you?” notification. Attackers have abused plain approve buttons by sending prompt after prompt until the person taps yes. CISA recommends number matching, where you must type a number shown on the login screen into the app, as a sensible interim measure when you cannot yet use something stronger.

4. A security key or passkey (FIDO and WebAuthn). This is the strongest kind. A security key is a small device you plug in or tap, and a passkey is a similar login stored on your phone or computer. CISA says the only widely available phishing-resistant authentication is FIDO and WebAuthn, and explains why: when an attacker tricks you into logging in to a fake website, the protocol blocks the attempt. In plain words, the key checks the real address of the website, so it simply will not work on a lookalike.

Which kind should you use?

Use the strongest kind each account allows, and never skip the second step because the best kind is not on offer.

• Where the choice exists, pick in this order: security key or passkey, then authenticator app, then text message.
• Do not wait for perfect. Text message codes today beat no second step today.
• Number matching beats a plain approve button. If your account has the option, turn it on.
• Keep a backup way in. Save the recovery codes the service gives you, and store them in a safe place, not in an email in the same inbox you are protecting.

Which accounts first

Start with the accounts that unlock everything else, then work outwards.

1. Your email. Whoever controls your email can click “forgot password” on almost every other account. This is the most important one.
2. Your domain registrar and website hosting. These control whether your website and email exist at all.
3. Banking and payment accounts.
4. Your website’s admin login. A second step on the login page protects the site from stolen or guessed passwords.
5. Social media and advertising accounts, which are often taken over and used to scam your customers.
6. Your password manager, because it holds the rest.

Common mistakes

• Turning it on for the boss only. Attackers pick the easiest person on the team. Everyone with access to company accounts needs it.
• One shared phone number. If the code for a shared account goes to one person’s phone, the business is stuck when that person is away or leaves.
• Losing the phone with no recovery codes. Plan for this before it happens.
• Approving a prompt you did not start. If a login prompt arrives and you did not try to log in, someone has your password. Say no, then change the password.
• Assuming it replaces strong passwords. It adds to them. A unique password for each account is still the first layer. A password manager makes that practical, and our free password generator shows what a strong one looks like.

Want help rolling it out across your team?

Switching it on is easy for one person and messy for a team: different phones, shared logins, people who leave. If you want the whole team set up with a password manager, strong logins and a second step that does not slow people down, see our heylogin password management service.

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

Sources and further reading

• Multifactor Authentication, CISA (US). Source for the definition of MFA, a complex password still being beatable, and the “99% less likely to be hacked” figure.
• More than a password, CISA (US). Source for not all MFA types being equal, any MFA being better than none, FIDO and WebAuthn as the only widely available phishing-resistant option, and number matching as an interim measure.