Two-factor
authentication (2FA)

Why the password isn't enough

After episode 2 you have unique, strong passwords. One of them could still end up in the wrong hands tomorrow — via a phishing page you didn't see through, a service that leaks, or malware on a borrowed computer. Two-factor authentication (2FA, sometimes MFA) means logging in requires something beyond the password: something you have (a phone, a security key) in addition to something you know.

The effect is dramatic. Microsoft's security research has long shown that multi-factor authentication stops the overwhelming majority of automated account attacks — the commonly cited figure is over 99 percent. The automated credential-stuffing wave from episode 1 simply bounces off an account with 2FA.

The hierarchy — not all 2FA is equal

There are four common methods, and the gap between best and worst is wide. From weakest to strongest:

Method	How it works	Weakness
1. SMS code	A one-time code is sent to your number.	Vulnerable to SIM swapping and telecom interception. After the breaches of US telecom carriers, the FBI and CISA have explicitly advised against SMS-based 2FA where better options exist.
2. TOTP app	The app generates a time-based six-digit code locally on your phone.	The code can still be phished in real time (see AiTM below), but nothing travels over the phone network.
3. Push notification	You approve the login with one tap in an app.	Convenient — but opens the door to "MFA fatigue", where the attacker spams requests until you tap yes.
4. Hardware key / passkey	A physical key (e.g. YubiKey) or a passkey using the FIDO standard. The cryptography is bound to the correct web address.	Practically phishing-proof. The weakness is the price and that a key can be lost — keep two.

Three attacks that bypass 2FA

SIM swapping

The attacker persuades (or bribes) your mobile carrier's support desk to move your number to a new SIM card. From then on, your SMS codes land with the attacker. That's why SMS sits at the bottom of the hierarchy — and why your mobile subscription should have its own PIN with the carrier if they offer it.

AiTM phishing (Adversary-in-the-Middle)

A fake login page that relays everything you type — including your TOTP code — to the real service in real time, then steals the logged-in session. Ready-made toolkits for this are sold openly. Only method 4, hardware keys and passkeys, is immune: the cryptography refuses to work on the wrong domain.

MFA fatigue

The attacker already has your password and hits "log in" again and again until, out of sheer irritation (or half-asleep), you approve the push notification. Defence: never approve a request you didn't just initiate yourself — and treat it as proof that your password is loose. Change it immediately.

Apps and backup codes

For TOTP codes we recommend, in descending order:

• Ente Auth — open source, encrypted sync between devices, polished interface.
• Aegis (Android) — open source, local storage with encrypted export. For those who don't want cloud sync at all.
• Authy — established, smooth multi-device sync, but closed source and requires a phone number.

Your password manager from episode 2 can often store TOTP codes too. Purists object that both factors then live in the same vault — true, but the vault is itself protected by a passphrase plus 2FA, and convenience that makes you actually use 2FA everywhere counts for a lot.

Backup codes — your lifeline

When you enable 2FA you almost always receive a set of one-time codes. Save them. Lose your phone without backup codes and you can be permanently locked out of your own account — some services (notably Google) are unforgiving. Print them or copy them onto paper, store them at home in the same safe place as your passphrase, or as an encrypted note in your password manager.

Where to enable 2FA first

You don't need everything at once. Take them in this order — the first three tonight:

1. Your email account. The master key. Can reset everything else.
2. Your password manager. The vault holding every other key.
3. Bank and payments. National e-ID schemes count — but enable extra protection where offered, and set a PIN on your mobile subscription against SIM swapping.
4. Social media. Frequently hijacked to scam your contacts (episode 1, the Group List).
5. Cloud storage and everything else that matters. Photos, documents, work.

Sources

Want to dig deeper? These are the sources behind this episode.

1. Microsoft Security — One simple action you can take to prevent 99.9% of attacks on your accounts.
2. CISA — Mobile Communications Best Practice Guidance — the guidance advising against SMS 2FA.
3. CISA — Turn on MFA — baseline MFA recommendations.
4. FIDO Alliance — fidoalliance.org — the standard behind passkeys and security keys.
5. Yubico — yubico.com — hardware keys.
6. Ente — Ente Auth — authenticator app with encrypted sync.
7. Aegis — getaegis.app — authenticator app for Android, local storage.
8. Authy — authy.com — authenticator app with multi-device sync.
9. OWASP — Multifactor Authentication Cheat Sheet — technical deep dive.
10. NIST — SP 800-63B — authentication assurance levels and method requirements.
11. Google — 2-Step Verification and backup codes — practical setup guide.