Security & Privacy
A calm, step-by-step guide to turning on two-factor authentication, the simple extra login step that keeps your accounts safe even if a password leaks.
Two-factor authentication (2FA) forces an account to demand two independent proofs before it opens: something you know (your password) and something you have (a code from your phone or a hardware key). Turning it on takes about three minutes per account, and it means a leaked or guessed password is no longer enough for anyone to get in. Start with your primary email, then your bank, and use an authenticator app rather than text messages wherever the service allows it.
The most common form of 2FA runs on a standard called TOTP, short for Time-based One-Time Password, defined in RFC 6238. When you scan the QR code a service shows you, your phone is not photographing a picture of a code. It is reading an otpauth:// link that contains a shared secret key. From then on, your authenticator app and the service both run the same math on that secret plus the current clock, producing a fresh six-digit number every 30 seconds. Nothing is transmitted over the internet or the phone network at login time, which is exactly why this method resists interception.
That detail matters for one practical reason: if you screenshot the QR code and leave the image in your camera roll or cloud photos, anyone who later sees that picture can clone your second factor. Scan it, confirm one code, and delete the screenshot.
Any second factor beats none, but they are not equal.
The service texts you a code. It is universally supported and far better than nothing, but it is the weakest option because the code lives on the phone network. Attackers defeat it two ways: SIM swapping, where they convince your carrier to move your number to their SIM, and SS7 attacks that intercept the message in transit. Use SMS only when a service offers nothing better, and never as the recovery method for your email.
Free apps that generate TOTP codes locally: Google Authenticator, Microsoft Authenticator, Authy, 2FAS, Aegis (Android, open source), or Ente Auth (cross-platform, open source). Because the codes are computed on your device, SIM swaps and network interception do not touch them. This is the sweet spot of security and convenience for the vast majority of accounts.
Some services, and corporate logins using Duo or Microsoft Authenticator, send a "Was this you? Approve / Deny" prompt. Convenient, but vulnerable to MFA-fatigue attacks, where a thief who already has your password spams you with prompts hoping you tap Approve to stop the buzzing. Modern versions counter this with number matching, showing a two-digit number on the login screen that you must type into the app. If your app offers it, keep it on and never approve a prompt you did not trigger.
Passkeys and physical keys such as a YubiKey 5 or Google Titan use the FIDO2/WebAuthn standard. Their superpower is that they are phishing-resistant: the key is cryptographically bound to the real website's domain, so it simply will not respond to a lookalike phishing page. This closes a gap that even authenticator apps leave open, described below. A YubiKey connects by USB-C, USB-A, or NFC tap; a passkey can live in iCloud Keychain, Google Password Manager, or on the key itself. Worth it for email, banking, and password-manager accounts.
The pattern is nearly identical on every service, so once you learn it, you can repeat it everywhere.
The whole loop takes two to three minutes. From then on, a login on a new device asks for your password plus the latest code from the app.
Do not try to protect everything in one sitting. Work in order of blast radius, and protect your email account first, because it is the password-reset point for almost everything else. If someone owns your inbox, they own the rest.
After email, do your bank and any payment account, then your password manager, then cloud storage and main social accounts. Menu wording shifts as apps update, so if a label differs slightly, look for anything containing "two-step," "two-factor," or "security."
When you enable 2FA, the service gives you a set of one-time recovery codes, usually eight to ten of them. These are your way back in if your phone is lost, stolen, or wiped. Print them or write them down and keep them where you store important paper documents, or save them inside a dedicated password manager entry. If your authenticator app supports an encrypted export (Aegis and Ente Auth do, and Google Authenticator now syncs to your Google account), set that up too, so a broken phone is an inconvenience rather than a lockout.
This is general guidance for building safer habits, not tailored security advice. If you suspect an account has been broken into, contact the provider through their official channels and, for fraud or identity theft, notify your bank and the relevant authorities where you live.
Yes, as long as you prepared. Your backup codes will get you in, and if your app syncs or has an encrypted export, you can restore your codes to a new phone. Set up at least one recovery method before you ever need it, because scrambling after the phone is gone is the hard way.
Absolutely, and you should. One app like 2FAS, Aegis, or Microsoft Authenticator can hold dozens of accounts, each with its own rotating code. It is more convenient and no less secure than spreading them across multiple apps.
A passkey is a phishing-resistant credential that can replace your password entirely or act as a very strong second factor, using the same FIDO2 technology as a hardware key. Traditional 2FA adds a second step on top of a password; a passkey can remove the password problem at the root. When a service offers passkeys, they are usually the best option available.
No. Most services remember trusted devices, so you enter a code only on a new device, after clearing cookies, or every 30 days or so. Day to day on your own laptop and phone, you will rarely be asked, while anyone logging in from an unfamiliar device is stopped cold.
Theo writes about online safety the way a good friend would — clearly, calmly, and without trying to scare you. He's interested in the simple habits that stop most problems, and he thinks staying private online is a skill anyone can learn.
Keep reading
A reassuring, jargon-free guide to spotting fake online stores, covering the warning signs in prices, contact details, payment options, and reviews.
Theo Vance
A calm, jargon-free guide to protecting your privacy on your phone, covering app permissions, location sharing, lock screens, and trimming back data tracking.
Theo Vance