Two-Factor Authentication (2FA) Explained: Why One Password Is Never Enough

by

You’ve probably heard that you should enable “two-factor authentication” — but what is it exactly, why does it matter, and which type should you actually use? This guide gives you the complete picture.

What Is Two-Factor Authentication?

Two-factor authentication (2FA) requires two separate forms of proof to log in. The three categories of authentication factors are:

  • Something you know — a password or PIN
  • Something you have — a phone, hardware key, or smart card
  • Something you are — fingerprint, face scan, or other biometrics

2FA combines two of these. Even if an attacker steals your password, they can’t log in without the second factor.

Why Is 2FA So Important?

According to Microsoft, 2FA blocks 99.9% of automated account attacks. Password breaches happen constantly — but breached passwords alone are useless against 2FA-protected accounts.

Real scenario: Your password for Gmail is exposed in a data breach. Without 2FA, the attacker logs straight into your email. With 2FA, they hit a wall. They’d need physical access to your phone to proceed.

Types of 2FA Ranked by Security

1. Hardware Security Keys (Best)

Physical USB/NFC devices like YubiKey. Immune to phishing because they verify the site’s domain cryptographically.

# YubiKey setup for GitHub:
# 1. Buy a YubiKey 5 (~$50 at yubico.com)
# 2. GitHub > Settings > Security > 2FA > Security Keys
# 3. Click "Register new security key"
# 4. Insert YubiKey, touch the gold button when prompted
# 5. Done — future logins require a physical tap

2. Authenticator Apps (Very Good)

Apps like Google Authenticator, Authy, or Aegis (Android) generate time-based one-time passwords (TOTP) that change every 30 seconds.

# Setting up Google Authenticator for a service:
# 1. In your account security settings, select "Authenticator App"
# 2. A QR code appears — scan it with the Authenticator app
# 3. The app now generates 6-digit codes every 30 seconds
# 4. Enter the current code to verify setup
# 5. Save the backup codes somewhere safe!

# TOTP format: RFC 6238 standard
# Algorithm: HMAC-SHA1(secret, time/30)
# Output: 6-digit code, valid for 30 seconds

3. SMS Text Messages (Weak — But Better Than Nothing)

A one-time code sent to your phone via text message. The problem: SIM swapping attacks allow criminals to hijack your phone number by tricking your carrier.

SIM swap example: An attacker calls your mobile carrier, pretends to be you, claims they lost their phone, and requests your number be transferred to a new SIM they control. Now all your SMS codes go to them.

Use SMS 2FA only if no better option is available. It’s still vastly better than no 2FA.

4. Email Codes (Weakest 2FA)

A code sent to your email. This is only as secure as your email account itself — circular protection. Avoid when possible.

Setting Up 2FA on Common Services

Google Account

# Google 2FA Setup:
# 1. myaccount.google.com > Security
# 2. "2-Step Verification" > Get started
# 3. Choose: Google Prompt (push), Authenticator app, or Security key
# Recommended: Security key or Authenticator app
# Download backup codes and store them offline!

GitHub

# GitHub 2FA Setup:
# Settings > Password and authentication > Two-factor authentication
# Options: Authenticator app, SMS, or Security key
# Also enable "Require 2FA" for organizations you manage

Microsoft 365

# Microsoft MFA:
# admin.microsoft.com > Security > MFA
# Or per-user: aka.ms/mfasetup
# Best option: Microsoft Authenticator app with "number matching"
# (prevents MFA fatigue attacks)

What Is an MFA Fatigue Attack?

Attackers spam your phone with push notification approval requests, hoping you’ll tap “Approve” out of frustration or confusion. This is how Uber was breached in 2022 — an attacker sent dozens of MFA push requests to an employee who eventually approved one.

Defense: Use number-matching MFA (requires you to type a number shown on screen into the app) or use a hardware key instead of push notifications.

Backup Codes: Don’t Skip This Step

When you enable 2FA, you’ll get 8–10 backup codes. These are one-time codes to use if you lose your device. Store them offline — print them, write them down, keep them in a safe. If you lose both your phone and your backup codes, you can be permanently locked out of your account.

Wrap Up

Enabling 2FA takes five minutes and dramatically increases your account security. Start with your most critical accounts: email, password manager, banking, and work accounts. Use an authenticator app at minimum, and a hardware key if you want the best protection available.