Passwords are dead. In an era where database breaches release billions of credentials annually, relying solely on a string of characters is negligence. You typically rely on MFA (Multi-Factor Authentication) to secure your accounts, but not all "Factors" are created equal.
The Three Factors of Authentication
To understand MFA, you must understand the three categories of proof:
- Something you KNOW: A Password, PIN, or Security Question.
- Something you HAVE: A Smartphone (for codes), a Hardware Key (YubiKey), or a Smart Card.
- Something you ARE: Fingerprint, FaceID, or Iris Scan (Biometrics).
True MFA requires two different categories. Inputting two passwords is not MFA. Password + PIN is not MFA. Password + A code from your phone is MFA (Know + Have).
2FA vs. 2SV: The Subtle Distinction
- 2FA (Two-Factor Authentication): Strictly enforces the use of two different components (e.g., Password + YubiKey).
- 2SV (Two-Step Verification): Two steps, but not necessarily different factors. Receiving a code via Email is 2SV. Why? Because if your password was stolen via a keylogger, that same compromised computer might be logged into your email. You haven't proven you "Have" a separate device, only that you have access to another account.
The Hierarchy of Safety
Not all methods offer the same protection.
1. SMS / Email Codes (The Weakest)
Better than nothing, but vulnerable.
- SIM Swapping: Hackers social-engineer your carrier ("I lost my SIM, please port my number to this new SIM"). Once they have your number, they get your bank codes.
- Phishing: You can be tricked into typing the code into a fake website.
2. Time-Based One-Time Passwords (TOTP)
Apps like Google Authenticator, Authy, or Raivo.
- How it works: Your phone shares a secret "seed" with the server. Both calculate a code based on the current time.
- Security: High. The code is generated locally on your device. It never traverses the network (unlike SMS).
3. FIDO2 / WebAuthn (The Gold Standard)
Hardware keys like YubiKey or Passkeys (TouchID/FaceID).
- Phishing Proof: The protocol binds the login attempt to the specific domain (e.g.,
google.com). If you are on a fake site (g0ogle.com), the key simply refuses to sign the request. You cannot accidentally give away your credential.
Recommendation
Audit your critical accounts (Email, Banking, Cloud Provider). Disable SMS recovery if possible. Move to TOTP apps or, ideally, invest in a hardware key for your "Root of Trust" (usually your primary email account).