Two-factor authentication (2FA/MFA) requires a second proof of identity beyond a password — typically something you have (a phone, a hardware key) rather than only something you know.
Why it’s disproportionately effective
The large majority of account compromises rely on the password alone being obtained (via phishing, breach, or brute force). 2FA breaks that single point of failure — even a correctly guessed or leaked password is no longer sufficient on its own to log in.
Choosing a 2FA method
- Authenticator app (TOTP): widely supported, free, and meaningfully more secure than SMS
- SMS-based codes: better than nothing, but vulnerable to SIM-swapping attacks
- Hardware security keys: the strongest option, resistant even to sophisticated phishing
FAQ
Is SMS-based 2FA still worth enabling if it’s the weakest option?
Yes — it’s still far better than no second factor at all; upgrade to an authenticator app or hardware key when practical, but don’t skip 2FA entirely while waiting to do so.