Password is used to secure our accounts online, but not every time a password is sufficient to do so. People might use their password more than once, use weak passwords, inadvertently divulge passwords due to phishing attack, or get passwords leaked during a data breach. After the password becomes known, the person might access the account.
This is where two-factor authentication (2FA) can help.
It is a very basic concept in which instead of just requiring a person to prove his identity by one method, the account requires the user to prove the same using another method. It might be through a code generated via authenticator application or security key or any other method that is approved.
Imagine this scenario. To unlock your doors, there are usually two locks. While knowing the password allows you to unlock the first lock, but you still have to open the second.
The reason why two-factor authentication is important is that these two factors offer different proofs. The password is something you know and the security key or the authentication device is something you have.
2FA comes in handy when it comes to accounts with valuable information like email, social media, cloud storage, or even financial services. Email account is especially critical because it can be used for resetting passwords of other accounts.
However, not all second factors provide the same level of security.
Authenticator applications and hardware security keys can be considered better options than SMS codes as phone-number based authentication may be associated with some additional vulnerabilities, such as taking control of the phone number through SIM swap.
It should also be mentioned that two-factor authentication does not make it impossible to hack an account. The problem is that phishing could potentially lead to compromising the password and the authentication code.
This means that the security is multilayered.
Strong and unique password + 2FA + vigilance while looking at suspicious login pages provide much more safety than a password only.
After all, 2FA is not intended to make security complicated.
It just makes one compromised password useless.
