What is two-factor authentication (2FA)?

Two-factor authentication (2FA) means proving it’s you with two different kinds of evidence before an account lets you in — typically something you know, like a password, plus something you physically have, like your phone or a security key. The point is redundancy: a stolen password alone stops being enough, because the attacker still needs the second thing.

That’s the whole idea, and what is two-factor authentication is the easy half of the question. The rest of this post is why one factor quietly stopped being enough, what actually qualifies as a second one (and what doesn’t, whatever your bank’s website believes), how each method works under the hood, and the honest list of things 2FA still doesn’t fix.

Why one factor isn’t enough

A password is a single string. Once it exists it can be guessed, reused, phished, or bought off a breach-dump forum for a few dollars — and once someone has it, they have everything the account has, instantly, with nothing standing in the way.

That’s the actual failure mode behind most takeovers. Not a clever hack: just a password that already leaked somewhere else, tried here too, automatically, at machine speed, across thousands of sites at once. A password manager exists to break that reuse — 2FA exists for the times it didn’t.

Two-factor authentication doesn’t make that string harder to steal. It makes stealing it not enough on its own. The attacker can have the password in full and still be standing outside, because the door needs a second, different kind of key they don’t have.

What actually counts as a second factor

Security people group evidence into three categories: something you know (a password, a PIN), something you have (a phone, a hardware key), and something you are (a fingerprint, your face). Real 2FA pairs evidence from two different categories.

Which is why two passwords isn’t 2FA — both live in the “know” category, so one method of theft (phishing, a keylogger, a breach) gets both at once. The same problem hides in “security questions”: your mother’s maiden name is something you know, and publicly researchable besides — a first factor in a fake moustache, not a second one.

Biometrics are the odd one out, worth a beat on their own. When your own device does the checking — Face ID, Touch ID, Windows Hello — the match happens on-device against a template locked in secure hardware, and the website only ever learns “the owner unlocked this thing.” Not a universal law: plenty of banking and ID-verification apps ship a selfie to a server to be matched there instead. Different, worse deal.

Which points at the useful way to think about it. In the good version your fingerprint isn’t the second factor at all — it’s the lock on the second factor, and the phone is the factor. Just as well, given you leave your fingerprint on every glass you touch and can’t exactly rotate it after a breach.

How each two-factor authentication method actually works

SMS codes are the most familiar and the weakest. The site texts a one-time code to your registered number, which means the thing being authenticated is the number, not you — and numbers come off people more easily than people expect. A SIM swap (your carrier reassigns the number to someone else’s SIM after a convincing phone call) puts your codes on their handset, on schedule, correctly. That’s before you get to SS7 interception, and before the obvious one: a code you can read aloud is a code you can be talked into reading aloud.

This isn’t just blog opinion any more. NIST finalised SP 800-63B-4 in July 2025 and put SMS codes in a new “restricted” category — still allowed, no longer good enough for its higher assurance level. Better than nothing. Bottom of the list.

Authenticator apps fix that specific hole with TOTP — time-based one-time password, RFC 6238. Scanning the setup QR code hands your phone a shared secret. After that, both sides take the secret, chop the current time into thirty-second buckets, run the two through HMAC, and truncate the result down to six digits. Same inputs, same output, no network anywhere in the loop — your phone will cheerfully produce valid codes in a Faraday cage, and there’s no carrier left to sweet-talk.

The catch nobody puts on the marketing page: that secret is shared, so the website holds a copy too. Breach the website, leak the seeds.

Push-based approval skips the typing entirely — the site sends a “was this you?” prompt straight to an app on your phone. What that prompt looks like matters more than it sounds, which the next section covers.

Hardware keys and passkeys don’t really belong on this list, and that’s the interesting part. The browser binds them to the exact domain they were registered against, so a lookalike phishing page can’t even ask the right question — nothing leaves your device but a signature that’s worthless anywhere else.

Strictly, they aren’t a second factor at all. They collapse the whole ritual into one tap: the device proves possession, the Face ID or PIN proves it’s you holding it, and the password stops existing rather than getting a bodyguard. A hardware key is the same machinery wearing a USB connector. We pulled passkeys apart in their own post.

The honest ranking

Ranked by what stops an attacker, not by what’s easiest to set up.

SMS is better than nothing, and that’s the whole compliment. An authenticator app closes the carrier hole and is where most people should land for most accounts. Push with number matching is roughly the app’s equal and considerably less annoying; push with a bare approve button is a worse app.

Hardware keys and passkeys sit alone at the top, for the reason above: they’re the only option a phishing page can’t get anything out of even with your enthusiastic help.

None of which means buy a hardware key for the sourdough forum — match the tier to what the account is worth. An app on a login you use twice a year is plenty; your email and your bank earn the top tier, and your email is worth more than your bank, because it can reset your bank.

What 2FA doesn’t fix

Codes can still be phished. A six-digit TOTP code is just a string, and adversary-in-the-middle kits sit between you and the real site, passing your password and your code straight through while you watch a loading spinner. Everything you typed was genuine. It just went through someone else on the way.

The part people miss is that the code was never the prize. What the attacker keeps is the session cookie the successful login hands back — which is why a thirty-second expiry saves nobody, and why changing your password afterwards doesn’t evict them. You have to sign out every active session. This is the specific gap passkeys close and codes structurally cannot.

Push approval has its own failure mode: MFA fatigue. An attacker who already has your password fires off approval prompts at 2am, over and over, betting you’ll tap “yes” to make the buzzing stop. It worked on Uber in 2022, and on Cisco — an actual security vendor — a few months earlier, which is roughly the ceiling of “this only happens to careless people.”

The vendors have mostly patched the tap-yes part out. Microsoft Authenticator has enforced number matching by default since May 2023, and Duo and Okta ship the same idea: the login screen shows you a number, you type it into the app, no yes button left to fumble half asleep.

What number matching doesn’t fix is the part that actually finished both breaches: afterward, someone contacted the victim claiming to be IT and talked them through approving it. So the rule has two halves — deny anything you didn’t trigger, and treat the “helpful” colleague who messages about it thirty seconds later as part of the attack, not the resolution. Even the top tier has a version of this: a current downgrade trick makes a phishing proxy claim your browser doesn’t support passkeys, so the site helpfully offers SMS instead.

And recovery flows still walk around all of it. None of this matters if “lost your phone” resolves with a code emailed to an inbox that has no second factor of its own — attackers rarely break 2FA, they just try every other door on the building. The 47-minute Instagram recovery is that story end to end: the account had 2FA, and the attacker never touched it, because changing the recovery email was easier.

Ready for the ten-minute version?

The name is the joke and the thesis at once: your accounts need two factors, and you, having read all of that, could probably use a session. We won’t bill you for either.

This post was the concept. The first-session walkthrough is the practice — which accounts to secure tonight, why the SMS option your bank keeps pushing is the one to skip, and ten minutes that matter more than every word above them.