Two-factor authentication, without the complication

Two-factor authentication means asking for two proofs instead of one before an account opens: something you know (the password) and something you have (the phone in your pocket, or a small key on your keyring).

The reasoning is simple. A thief on the other side of the world may well have your password, bought from a list or scooped up in the breach of some site you barely remember joining. What he cannot have is your phone. With a second factor switched on, a stolen password is worth very little, and that makes this the single security measure with the best result for the least effort.

Here is how it works, which methods are worth using, and above all how to avoid being locked out yourself the day the phone goes in the lake.

Why a password on its own is no longer enough

It is not a question of strength. Even an excellent password leaves with all the others when the site storing it gets breached.

Then there is phishing: a convincing fake page imitating your bank or your email provider, where you type your own credentials without suspecting anything. The password is handed over, not guessed.

In both cases the second factor is the net. The thief reaches the next step, the site asks for the code, and he does not have the phone. The attempt stops there, and you get a notification telling you it is time to change that password.

The methods, weakest to strongest

A code by text message (SMS). A six-digit code sent to your phone number. It is the most widespread method and the easiest to set up.

A code from an authenticator app. An app on the phone shows a six-digit code that changes every thirty seconds. It works with no signal and no data, on a plane included.

A notification to approve. The service sends a request into its own app and you tap “Yes, that’s me”. Quick and simple.

A physical security key. A small object that plugs into USB or taps against the phone. It is the strongest method and the one that demands the most organisation, because you should buy two and keep the spare somewhere else.

A passkey. The newest option: your device proves who you are with a fingerprint or your face, replacing the password and the second factor at once. When a site offers one, take it.

Why text messages are the weakest of the good options

Let us be clear about this: a text code is vastly better than nothing. If it is the only option a site offers, switch it on without hesitating.

It has two real weaknesses, though.

The first is SIM swapping. Someone phones your mobile provider, poses as you using details found online, and has your number moved to their own SIM card. From then on, your text messages arrive at their phone. It is not common, but it targets precisely the people with something worth stealing.

The second is more mundane: a texted code can be repeated to someone. A fake page asks for your password, then displays “enter the code you have just received”, and the fraudster types it into the real site within the minute. The code genuinely did come from your bank, which is exactly what makes the trick work.

A text also travels unencrypted and often appears on the lock screen, readable by anyone who picks up the phone.

So: turn on SMS if it is all that is available, but when a site offers an authenticator app, move to the app.

Using an authenticator app

For most people this is the right balance: clearly stronger than SMS, far less fuss than a physical key.

Setting it up takes two minutes per account.

1. In the site’s security settings, choose “authenticator app”.
2. The site displays a square of dots, a QR code.
3. Open the app on your phone and photograph that square.
4. The app immediately shows a six-digit code. Type it back into the site to confirm.
5. The site then shows you a list of backup codes. Do not close that page. More on those below.

After that, each time you sign in on a new device, you open the app and copy the code it is showing.

Plenty of password managers now do this too and display the code as they fill the form, which is very comfortable. A purist will say that keeping the password and the code in the same place weakens the whole idea of two separate factors, and the purist is not wrong. In practice, for an ordinary account, convenience wins: protection you actually use beats protection you switch off after a month. For your main email and your bank, keep them apart.

Backup codes: the thing to do today

This is the step everyone skips, and it is the one that causes the real disasters.

When you turn on a second factor, the service hands you a list of single-use backup codes, usually eight or ten. Each one stands in for the phone exactly once.

Print them, or copy them out by hand, and file them with your important papers. The passport, the birth certificate, the insurance documents: same drawer. Not in the phone, since the problem you will be solving is the absence of the phone. Not in an email to yourself, since the locked account may well be that one.

Do it at least for your main email and your bank. Ten minutes once in your life, against a week of paperwork on an unlucky day.

What if I lose my phone?

This is the fear that stops thousands of people from turning anything on. Here is the honest answer, in order.

1. Use a backup code. If you printed them, this is over in two minutes.
2. Use another device that is already trusted. A tablet or a computer where you are still signed in is often enough to approve the login and enrol the new phone.
3. Restore the authenticator app. Most current authenticator apps back their codes up to your cloud account. On a new phone they come back with all your accounts attached. Check that setting today rather than on the day.
4. Go through the service’s account recovery, which always exists but takes days and asks for proof of identity.

Two habits prevent most of the trouble: keep a second method active on important accounts (the app and a phone number, say), and print the backup codes.

Which accounts come first

You do not have to protect everything tonight. The order matters more than the number.

1. Your main email, before anything else. It is the master key: whoever controls it can reset the password on nearly every other account by clicking “forgot password”. If you do only one thing after reading this, do that one. It is also what makes a locked email account so paralysing.

2. Banking and financial services. Often mandatory already, sometimes only by text. If your institution offers the app, take the app.

3. Anything holding a credit card. Amazon, the grocery order, the app stores.

4. The Apple, Google or Microsoft account behind your devices. It controls photos, backups and the phone’s location.

5. Social media. Less critical financially, but a stolen account gets used to defraud the people who trust you.

What it actually changes day to day

Less than you fear. Sites do not ask for the code on every visit: they remember the device, often for thirty days or more. On your usual computer you will see the prompt a handful of times a year.

The code shows up mainly when you sign in from a new device or a new browser, which is precisely the situation where you want a door closing behind a stranger.

And if an approval request appears when you are not trying to sign in anywhere, refuse it, then change that account’s password immediately. It means someone already has your password and is knocking. The reflex is the same one that defeats a fake tech-support alert: approve nothing in a hurry.

Where to start this week

1. Turn on a second factor for your main email.
2. Choose an authenticator app if the site offers one, otherwise text messages.
3. Print the backup codes and file them with your important papers.
4. Do the same for banking.
5. Add the other accounts over the following months, at your own pace.

A password manager plus a second factor is close to everything an ordinary household needs. If you would rather have someone sit with you, work through it account by account, and check the backup codes are genuinely in your hand before leaving, that is what our security and privacy and email and online accounts services cover.