Two-Factor Authentication, Explained Without the Lecture

Two-factor authentication is explained badly in both directions: either as an obvious thing everyone should obviously do, or in enough detail to be a lecture. Here is the middle version, and in particular the part that goes wrong, which is not the security and is the recovery.

The idea is simple. A password is something you know, and things you know can be copied without you noticing — through a leak at a company you have an account with, or by being reused somewhere less careful, which on a small team can mean the software nobody approved. A second factor is something you have, so that knowing the password is not enough. That is all it is.

The three common forms, in ascending order of how much they help.

A code by text message. Better than nothing, and it is the one most people have. Its weakness is that a phone number is not really something you have — it is something your mobile provider can be persuaded to hand over, and that persuasion is a known, practised attack. If it is the only option a service offers, use it.

A code from an app. The six-digit code that changes every thirty seconds. The app and the service share a secret when you set it up, and both compute the same code from that secret and the current time, which is why it works with no signal. This is genuinely good and it is what I would use for almost everything.

A physical key. A small device you tap or plug in. The strongest, because it also verifies which site is asking, which means it does not work on a convincing fake — the one attack the other two cannot see. Worth it for the two or three accounts that could be used to reset everything else, chiefly your email.

Now the part that actually causes problems. Every one of these fails the same way: you lose or replace the phone, and the second factor is on it. I have watched this happen three times and it is genuinely painful — the recovery process for a serious account can take days and sometimes requires documents.

So the setup step that matters more than which method you choose: when a service shows you recovery codes, save them somewhere that is not the phone. Print them, or put them in a password manager on a different device, or write them on paper in a drawer. It takes ninety seconds and it is skipped essentially always, because it comes at the end of a setup you are already tired of.

The second protective step is to use an authenticator app that syncs across devices, so replacing a phone does not mean losing every code. Purists will point out that this reduces the guarantee slightly, and they are right, and I still think it is the correct trade for most people, because the failure mode it prevents is common and the one it enables is not.

If you do nothing else after reading this: put app-based two-factor on your email account, and save its recovery codes off the phone. Email is the account that can reset the others — whichever provider hosts it — which means its security is a ceiling on everything else you do, and it is the one people most often leave on SMS.