That code from your phone after your password feels like one annoying step too many. It’s also one of the most effective things you can do to protect an account. Here’s why.
Perfect for sending to someone who won't read a whole article.
You know the drill. You type your password, and then the site wants a code from your phone before it lets you in. Mildly annoying, one more step between you and your email. But that extra step is one of the single most effective things you can do to protect an account, and it is worth thirty seconds to see why.
Two-factor authentication means proving who you are with two different things instead of one. Usually your password, plus a code on a device you are holding. Stealing one of the two is not enough to get in.
Think about how a well-protected house works. To get in, a burglar needs both your house key and the code to disarm the alarm. Getting hold of just one does them no good. The key alone sets off the alarm; the code alone opens nothing.
That is exactly what two-factor authentication does for an account. Your password is the key. The code from your phone is the alarm code. Even if a crook steals your password in a breach or a scam, they hit a second locked door they cannot open, because that second factor lives on a device in your pocket. One stolen piece is no longer the whole break-in.
The “factors” are meant to be different kinds of proof: something you know (the password), something you have (your phone or a hardware key), or something you are (a fingerprint or face). Two of the same kind does not count, which is why a password plus a security question is weak; both are just things you know.
Not all second factors are equal. A code from an authenticator app is stronger than a code texted to you, because text messages can be hijacked through SIM swaps. Strongest of all are hardware security keys, which are resistant even to phishing, since they refuse to hand their proof to a lookalike site. If a service offers a choice, an app beats a text.
One factor can be stolen. The whole point of two is that stealing one still leaves the door locked.
Turn it on for the accounts that would hurt most to lose first: your primary email, your bank, anything with your money in it. Your email especially, because it is the master key that can reset the passwords to everything else. Protect that one and you have protected far more than it looks.
One short email: the scam making the rounds, one tech word made simple, and one tip to keep you and your family safe. Free, no spam, unsubscribe anytime. Plus a free printable "How to Spot a Scam" sheet for your fridge.
We send one email to confirm it's really you. Your address stays with us and our email service, nobody else. Privacy
The cloud isn't in the sky. It's in giant, humming, refrigerated warehouses full of computers, and they're hungry for electricity and water. Here's what a data center is.
New phones are ditching the little SIM card tray. An eSIM is the same thing, built in and programmed over the air, like a hotel updating your key card without a trip to the front desk.
Click every traffic light. Now do it again. CAPTCHAs are bouncers that keep robots out, and if you keep failing them, the problem is probably your connection, not you.
