Two-Factor Authentication: Which Second Step to Choose

A second factor stops most account takeovers. Not all second factors are equal, and the weakest is still far better than none.

The principle

Multi-factor authentication asks for two or more kinds of evidence: something you know, something you have, or something you are. A stolen password is then not enough. See Wikipedia's article on multi-factor authentication.

The common options, weakest to strongest

1. Text message codes. Easy, and widely supported. Vulnerable if someone takes over your phone number.
2. Authenticator apps. Codes are generated on the device and change every thirty seconds. No mobile signal required.
3. Push approval. Convenient, but people approve prompts by reflex. Only approve a prompt you caused.
4. Security keys and passkeys. Bound to the genuine site, so a fake login page cannot use them.

Where to turn it on first

• Your main email account, because password resets for everything else go there.
• Banking, payments and any account that holds money.
• The account for your phone number itself.

Recovery codes

When you enable a second factor you are usually given backup codes. Print them or store them in a password manager. Losing your phone without them can mean losing the account.

One thing it does not stop

If you type a code into a convincing fake site, the attacker can relay it in real time. Check the address before entering a code, or use a method that checks it for you.