MyRecon OSINTTwo-Factor Authentication: Why It Matters and How to Set It Up
A password is a secret that can be copied without you knowing. Every breach on this site's archive exists because copied secrets keep working. A second factor breaks that, but the methods differ enormously in what they actually stop, and the one most people have is the one that stops the least.
What a second factor is for
Authentication factors come in three kinds: something you know, something you have, and something you are. Two-factor authentication means using two different kinds, so that compromising one leaves the attacker still outside.
The reason this matters so much in practice is narrower than it sounds. The dominant attack against ordinary accounts is not someone guessing your password, it is credential stuffing: taking email and password pairs from one company's breach and replaying them, automatically, against hundreds of other services. Any second factor at all defeats that outright, because the attacker has the password and nothing else. That is why enabling the weakest form of 2FA is still a step change from having none.
What differs between methods is how they hold up against an attacker who is targeting you, in real time.
The methods, ranked by what they actually resist
1. Passkeys and hardware security keys: the only phishing-resistant option
These use public-key cryptography. Your device holds a private key; the service holds the matching public key; logging in means signing a challenge. The secret never leaves the device, so there is nothing to intercept, replay or read out over the phone.
The property that makes them categorically different is origin binding. The credential is tied to the real site's domain, and the browser will not offer it to any other. A perfect visual replica of your bank at a lookalike domain cannot use your passkey, because the request comes from the wrong origin and the device simply declines. It is not that the user is expected to notice the fake, the mechanism cannot be fooled by it.
Two forms exist. A hardware security key is a physical device that never syncs anywhere; the strongest option, and the reason to buy two so that losing one is an inconvenience rather than a lockout. A synced passkey lives in your phone or password manager and is backed up, which trades a little of that isolation for not being locked out when you drop your phone. For almost everyone, synced passkeys are the right default.
2. Authenticator apps (TOTP)
The familiar six-digit code that changes every thirty seconds. At setup the service shows a QR code containing a shared secret; your app stores it and both sides derive the same code from that secret plus the current time. It works offline, and it is not tied to your phone number, which removes the entire SIM-swap problem.
Its weakness is that the code is a secret you can be persuaded to hand over. A real-time phishing proxy, a fake login page that forwards what you type to the real site as you type it, collects the code and uses it within its thirty-second life. You cannot detect this by being careful with the code, because the code is being used correctly, just not by you.
One setup detail with consequences: the QR code is the secret. Screenshotting it into a cloud photo library means the second factor now lives wherever those photos live, which is frequently the same account the password protects.
3. Push approval
A prompt on your phone: approve or deny. Convenient, and better than a code you might read aloud. Its failure mode is prompt fatigue, an attacker with your password triggers approvals repeatedly, at night, until someone taps approve to make it stop. Implementations that show a number you must match from the login screen largely fix this and are worth turning on where offered.
4. Email codes
Exactly as strong as your email account and no stronger. If your mailbox is compromised, every service that falls back to email has been compromised with it. Acceptable as a backup, poor as a primary.
5. SMS codes
The most common and the weakest. A phone number is not something you have in any durable sense, it is an account with your mobile operator, and it can be moved. In a SIM swap, someone persuades or bribes carrier staff to port your number to their SIM, and every code follows it. This is not theoretical; it is the standard method for stealing high-value accounts, and it has been used against people whose only mistake was having a phone number.
And yet: SMS still stops credential stuffing completely. If SMS is the only option a service offers, use it. Just do not rely on it for the accounts that matter most, and do not leave it enabled as a fallback on an account that has something stronger, a fallback is a bypass, and an attacker will simply choose it.
The single most valuable change: remove SMS as a recovery path on your email account. Email is the master key, nearly every other account can be reset through it. An attacker who controls your number does not need your email password, only the reset flow. Where a service allows an authenticator app or a passkey with SMS disabled entirely, that is the configuration worth the ten minutes it takes.
Where 2FA does not help
Three routes go around it entirely, and knowing them prevents a false sense of completion.
- Stolen session cookies. After you authenticate, the site gives your browser a token that proves you already did. Malware that steals that token can load it into another browser and be logged in with no password and no second factor, because from the service's perspective authentication already happened. This is why "sign out of all devices" is the urgent step after a device compromise, see stealer logs.
- Account recovery. Every 2FA system needs a way back in for people who lose their device, and that path is often the weakest thing on the account: a support agent, a set of security questions, a scan of a document. Attackers attack recovery, not authentication.
- Consent to something else. Approving an OAuth application, an app password, or a device that then keeps its own long-lived access. Reviewing connected applications periodically is part of the same job.
Recovery codes are the real single point of failure
When you enable 2FA you are usually shown a list of one-time backup codes. These bypass the second factor completely, by design.
Two failures follow from ignoring them. Losing them along with your phone means losing the account permanently, with a passkey or an authenticator app and no backup, there may be no human anywhere who can restore it. And storing them badly means storing a full bypass: in a note in the same email account, or in a file called codes.txt, they are simply a password with extra steps.
Store them in a password manager under a different master password, or print them and keep the paper where you keep documents. Then delete the copy in your downloads folder.
What to enable, in order
- Your primary email account. Everything resets through it. Strongest method available, SMS removed as a fallback.
- Your password manager. The vault is the rest of your life.
- Banking and anything holding a payment method.
- Your phone carrier account. The place a SIM swap is executed. Most carriers offer a port-out PIN or a port freeze, and almost nobody sets one.
- Domain registrar and cloud accounts, if you have them. A hijacked domain takes the email and the site with it.
- Social accounts, which are the ones used to reach everyone who trusts you.
Enrol two methods on anything important, then test the second one. A passkey and an authenticator app, or two hardware keys. The moment a single device is both your only factor and your only recovery route, an ordinary accident, a dropped phone, a wiped device, a stolen bag, becomes permanent loss of the account.
Passkeys are replacing the whole arrangement
It is worth being clear about where this is going. A passkey is not a second factor bolted onto a password; it replaces the password entirely, with the device unlock standing in for the thing you know. There is no shared secret on the server, so a breach of the service cannot leak anything that logs anyone in, the public key it stores is useless to an attacker. And because the credential is bound to the real domain, the most common attack against ordinary people stops being possible rather than becoming less likely.
The rollout is uneven and the recovery story is still the weak part, which is why backup methods and printed codes remain necessary. But where a service offers a passkey, taking it is the single largest security improvement available to an individual today.
Find out which of your accounts are already exposed, and therefore which to secure first, with the MyRecon email check.