# Two-factor authentication

> A second proof that you are you, so a stolen password alone is not enough.

- Level: Basic
- Topics: Security
- URL: https://tidbit.legios.com.ar/two-factor-authentication/
- In Spanish: [Autenticación de dos factores](https://tidbit.legios.com.ar/es/two-factor-authentication/)

**Two-factor authentication** (2FA, or MFA when there can be more than two) means logging in with two different kinds of proof: something you **know** (a password) plus something you **have** (your phone, a hardware key) or something you **are** (a fingerprint, your face). A password can be guessed, leaked or phished from across the world. Your phone cannot, at least not as easily.

In practice: you type your password, and the service asks for a six-digit code from an authenticator app, a tap on a notification, or a touch on a small USB key. Codes sent by SMS also count, but they are the weakest option, because attackers can take over a phone number by convincing the carrier to move it to a new SIM.

The strongest and most convenient option today is a **passkey** or hardware key: it only works on the real site, so a phishing page cannot ask you for it. For the rest, an authenticator app (Google Authenticator, Microsoft Authenticator, or the one inside your password manager) is a solid default.

Practical takeaway: turn it on for your email account first, because the email is what resets every other password. Then your bank, your main social network and your work accounts. Save the backup codes somewhere safe, so that losing your phone does not mean losing the account.

## An analogy

A debit card at the ATM: you need the card (something you have) and the PIN (something you know). A thief who shoulder-surfed your PIN still cannot withdraw a peso without the card.

## Keep in mind

- Two different kinds of proof: know, have, are. A second password is not a second factor.
- Authenticator apps and hardware keys beat SMS codes; SMS still beats nothing.
- Passkeys and hardware keys resist phishing because they only answer the real site.
- Enable it on your email first: it is the account that resets all the others.

## Go deeper

- [What is two-factor authentication? (Cloudflare Learning Center)](https://www.cloudflare.com/learning/access-management/what-is-two-factor-authentication/)
- [Multi-factor authentication on Wikipedia](https://en.wikipedia.org/wiki/Multi-factor_authentication)

## Related terms

- [USB](https://tidbit.legios.com.ar/usb/): The standard plug for connecting and charging almost everything.
- [Passkeys](https://tidbit.legios.com.ar/passkeys/): A way to sign in without a password, using your phone's or computer's lock instead.
- [Phishing](https://tidbit.legios.com.ar/phishing/): A fake message that tricks you into handing over a password or a payment.
- [Google](https://tidbit.legios.com.ar/google/): The search company that gives most products away and makes its money on ads.
- [Microsoft](https://tidbit.legios.com.ar/microsoft/): The company of Windows and Office, now just as much a cloud company with Azure.
- [Password manager](https://tidbit.legios.com.ar/password-manager/): An encrypted vault that remembers a different strong password for every site.
- [Backup](https://tidbit.legios.com.ar/backup/): A separate copy of your data, kept so you can get it back when the original is lost.