Security Signing in safely: 2FA, passkeys and account recovery
Two-factor authentication explained in plain English
What the second factor really is, which attacks it blocks, which ones it does not, the accounts to protect first, and the objections that keep people from turning it on.
The short answer
- Two-factor authentication means proving who you are twice, with two different kinds of proof, so a stolen password on its own stops working.
- Its main job is to defeat attackers who bought your password in a breach and are trying it from far away, which is how most ordinary accounts are taken over.
- Text message codes, app codes and push approvals all block that attack, but only passkeys and hardware keys also block a convincing fake login page.
- Set it up on the email address that receives your password resets before anything else, including your bank.
- Save the recovery codes the moment you turn it on, because losing the second factor is the failure people actually experience.
Two-factor authentication means an account asks for two different kinds of proof before it lets you in: normally something you know, your password, plus something you have, such as your phone or a small key on your keyring. The value is not that the second step is unbreakable, because none of them are. The value is that someone who bought your password in bulk from another company's data breach is sitting at a computer in another country and cannot produce the second thing. That one gap closes the most common route into ordinary accounts. Every method below has a weakness somewhere, and every one of them is a large improvement on a password alone.
The three kinds of factor
Security people sort proofs into three families, and the sorting is the whole idea.
Something you know: a password, a PIN, the answer to a recovery question. It can be copied without you noticing, because knowledge leaves the original behind.
Something you have: a phone that receives a code, an app that generates one, a USB key you touch. To steal it, someone has to reach into the physical world.
Something you are: a fingerprint, a face scan, an iris. On a phone this usually unlocks something stored on the device rather than travelling to the website, which is covered in face and fingerprint unlock.
Two-factor authentication is two proofs from two different families. A password plus a security question is not two factors, because both are things you know and both can be stolen in the same breach. You will also see the term multi-factor authentication, or MFA. It means the same idea with two or more steps, and for a normal personal account the two are used interchangeably.
What a second factor actually blocks
Being specific here matters, because vague reassurance leads people to trust the wrong method.
Credential stuffing is the big one. Attackers collect username and password pairs leaked from one company, then fire them automatically at hundreds of other sites, because so many people reuse passwords. This runs at enormous scale with no human involved. Any second factor stops it dead, because the automation has nothing to enter at step two. This is also why password reuse is the risk that a second factor most directly cancels.
Password spraying and guessing are the same story. A few common passwords tried against thousands of accounts will find matches, and still fail at the second step.
Old breached passwords are neutralized. If a password you used in 2018 is in a dump somewhere, the second factor keeps that dump from being useful today.
What a second factor does not block
A convincing fake sign-in page is the important exception. Modern phishing kits act as a relay: you type your password into the fake page, it passes it to the real site instantly, the real site sends you a code, you type the code into the fake page, and the attacker uses it within seconds. Text codes, app codes and simple push approvals are all vulnerable to this, because none of them can tell which website asked. Only passkeys and hardware security keys check the actual domain in the address bar and refuse to answer a lookalike, which is the single reason passkeys are treated as a different class of protection rather than just a better code.
Device theft is the second exception. If your password manager and your authenticator app both sit on one phone with a weak screen lock, a thief with that unlocked phone has both factors. The defense there is a six digit or longer device passcode and a separate lock on the password manager, not a different second factor.
Account recovery is the third. An attacker who cannot pass your second factor may simply claim to be you and reset the account, which is why recovery deserves setting up deliberately rather than by default.
The methods, and what each one resists
| Method | Stops stolen passwords | Stops a fake login page | Main weakness |
|---|---|---|---|
| Emailed code | Only if the email account itself is protected | No | Collapses if the mailbox is compromised |
| Text message code | Yes | No | SIM swap, number porting, no signal abroad |
| Authenticator app code | Yes | No | Lost phone with no backup, clock drift |
| Push approval | Yes | No | Approval fatigue: tapping yes to stop repeated prompts |
| Push with number matching | Yes | Partly | Still relies on you reading carefully |
| Passkey | Yes, no password involved | Yes | Syncing across different ecosystems |
| Hardware security key | Yes | Yes | Cost, and losing it if you own only one |
Read the table as a ladder rather than a verdict. A text code is the weakest row, and it still blocks the automated attack that causes most takeovers. Turning on the weak option today beats planning the strong option for a year.
Which accounts to protect first
- Your primary email account. Whoever controls it can request password resets everywhere else, so it is the master key whether you think of it that way or not.
- Your mobile carrier account. This one protects the phone number that other services text codes to. Ask for a port freeze or an account PIN at the same time.
- Banking, brokerage and payment apps, including any wallet holding cryptocurrency, where transfers are hard to reverse.
- Anything storing a card you can spend from: marketplaces, food delivery, app stores, travel sites.
- Cloud storage and photo backup, because these hold documents, scans of ID, and pictures of things you would rather not have leaked.
- Social and messaging accounts, which are used to scam the people who trust you.
- Work accounts, unless your employer has already enforced it.
Spend ten minutes on the first three. The rest can happen over a month.
The objections, answered honestly
I will lose my phone. This is the one real risk, and it is managed at setup rather than afterward. Save the recovery codes offline, register a second method, and read account recovery once before you need it.
I travel and have no signal. Text codes fail when roaming is off or coverage is poor. Authenticator app codes are generated on the device from a shared secret and the clock, so they work in airplane mode, which is why an authenticator app suits travelers better than text messages.
It will slow me down every day. In practice it asks once per device, then usually stays quiet for a month or more.
Where to start today
Open your email provider's security settings and turn on a second factor, choosing an app or a passkey over a text code if both are offered. Write the recovery codes on paper and put them somewhere you would keep a passport. Then do the same for your carrier account. If you only ever complete those two, you have removed the path that most account takeovers actually take.
Common questions
Does 2FA mean I have to do this every single time I sign in?
On your own devices, almost never. Most services offer a remember this device option that lasts 30 days or longer, so the code is asked for on a new device, a new browser, or after you clear cookies. The friction lands mostly on the attacker.
What happens if I lose my phone?
You use a recovery code, a second registered device, or the service's account recovery process. This is exactly why you save recovery codes at setup, and why registering a second method takes five minutes and saves days.
Is 2FA any use if my password is already strong?
Yes, because the attacks it stops do not involve guessing. A long unique password protects you against guessing and cracking. A second factor protects you when the password is stolen outright, from a breached site, from malware, or from a page you typed it into.
Can I use the same authenticator app for every account?
Yes. One app can hold dozens of accounts, each with its own six digit code. The thing to avoid is keeping the app on the same unlocked phone as a password manager with no separate lock, because then one stolen unlocked phone gives up both factors.