Two-factor authentication (2FA)

In short: With two-factor authentication you need two different proofs to sign in: something you know (password) and something you have (phone, security key) or are (fingerprint).

In more detail: A stolen password alone is then not enough. Common second factors are one-time codes from an authenticator app (TOTP), hardware keys (FIDO2/WebAuthn) and confirmations via an app. SMS codes are better than nothing but vulnerable to SIM swapping.

In Depth

• TOTP: a code that changes every 30 seconds and is calculated from a secret key and the time.
• Hardware keys: They check the web address and are therefore protected against phishing (Phishing).
• Recovery codes: Save codes when setting up. Without them a lost phone is a problem.
• Two factors ≠ two passwords: Two things from the same category do not count.
• Priorities: First secure your email account, password manager, bank and cloud.

See also: Passkeys, Password manager