Two-Factor Authentication: Why It Matters and How to Set It Up

If someone gets your password (and eventually someone will), two-factor authentication is the wall that keeps them out of your account.

How 2FA Works

Two-factor authentication requires two different types of proof:

1. Something you know: Your password
2. Something you have: A phone, a hardware key, or an authenticator app

Even if your password leaks in a breach, the attacker cannot log in without the second factor.

Types of 2FA (Ranked by Strength)

• Hardware security keys (FIDO2/WebAuthn): Physical USB or NFC devices. Strongest option. Immune to phishing
• Authenticator apps (TOTP): Apps like Authy or Google Authenticator generate time-based codes. Strong and convenient
• SMS codes: A code sent to your phone via text message. Better than nothing, but vulnerable to SIM swapping attacks
• Email codes: A code sent to your email. Weakest form because it depends on the security of your email account

Where to Enable 2FA First

1. Email accounts: Your email is the recovery mechanism for everything else. Secure it first
2. Financial accounts: Banking, investment, and payment platforms
3. Social media: High-value targets for impersonation
4. Cloud storage: Dropbox, Google Drive, iCloud contain sensitive documents
5. Password manager: The keys to all your other accounts

2FA and Disposable Email

For accounts created with disposable email, SMS or app-based 2FA is the better choice. Email-based 2FA would send codes to a disposable inbox, which works but means you need continued access to that inbox. If you use Another.IO, bookmarking the identity ensures the inbox stays accessible.