The Off-Key Bard
Technology

What Is Two-Factor Authentication Actually Protecting You From?

Or: they stole your password. Now what? 2FA means a stolen password alone isn't enough to get in — but not all 2FA is equally strong.

Or: They Stole Your Password. Now What?

You enter your username and password. Instead of opening your account, the website asks for something else — a six-digit code from an app, a text message, a fingerprint scan, a hardware key. For many people this feels like friction for its own sake.

But two-factor authentication is built around a specific, important insight: your password can be completely stolen, and the attacker still can't log in. Understanding 2FA means understanding what problem it actually solves.

The Threat It's Designed For

Passwords fail in more ways than most people realize. They get stolen in data breaches and sold on criminal markets. They get phished when someone clicks a convincing fake login page. They get guessed because people reuse passwords across services. They leak through malware that logs keystrokes.

None of these require hacking your specific account directly. An attacker can buy a list of millions of email-and-password combinations from a breach at one service and try them against another. This is called credential stuffing, and it works because password reuse is common.

2FA doesn't prevent your password from being stolen. It makes a stolen password insufficient to gain access on its own.

Why "Factors" Matter

Authentication systems distinguish between three categories of proof:

Something you know — a password, PIN, or security question answer. All of these exist purely as information, which means they can be copied, guessed, intercepted, or extracted without you noticing.

Something you have — a physical phone, a hardware security key, an authenticator app. These are harder to steal remotely because they require physical access or more sophisticated attacks.

Something you are — biometric attributes like a fingerprint or face scan. Importantly, modern systems don't send your biometric data to the server — they use it locally on your device to unlock a cryptographic key.

True multi-factor authentication combines evidence from different categories. Entering a password and then a security question isn't 2FA — that's two pieces of knowledge. A password plus a phone-generated code is 2FA. The second factor provides a different kind of proof that's harder to steal the same way the first one was.

Not All 2FA Is Equally Strong

There's a wide range of second-factor options, and they protect against meaningfully different threats.

SMS text codes are the most common and the weakest. A code is sent to your phone via text message. The problem is that phone numbers can be hijacked through SIM swapping — an attacker convinces your carrier to transfer your number to a phone they control. Some carriers have made this harder, but it remains a real attack vector. SIM swapping has been used to drain cryptocurrency accounts and bypass MFA on email. SMS is also vulnerable to phishing: a fake login page can request your code in real time and relay it to the real site before it expires.

Authenticator apps (TOTP) — Time-based One-Time Passwords — generate a fresh six-digit code every 30 seconds using an algorithm tied to a secret key and your device's clock. The code is calculated locally; no internet connection is needed. This eliminates the SIM-swapping vulnerability. However, TOTP codes can still be phished through real-time adversary-in-the-middle attacks, where a fake site captures your code the moment you enter it and immediately uses it on the real site. The window is narrow but the attack exists.

Push notifications ask you to approve a login attempt on your phone. This can be convenient, but it's vulnerable to MFA fatigue attacks: an attacker who has your password sends repeated approval requests until you accidentally accept one out of annoyance or confusion. Some services have addressed this with number matching — the approval prompt shows a number that you have to match to one displayed on the login screen, preventing blind approvals.

Hardware security keys and passkeys use cryptographic protocols (FIDO2/WebAuthn) that bind authentication to the specific domain you're logging into. When you set up a security key for a site, the key generates a cryptographic pair tied to that exact URL. A fake site can't collect a code to replay — the authentication simply won't work on a different domain. This makes hardware keys and passkeys the only commonly available option that's genuinely phishing-resistant. If someone creates a perfect clone of your bank's login page, your hardware key still won't authenticate to it.

The Practical Hierarchy

Starting from strongest to most accessible:

Passkeys and hardware security keys are the gold standard for accounts that matter most. They're immune to phishing and SIM swapping. The downside is hardware loss — you need a backup or recovery key.

Authenticator apps (TOTP) are significantly better than SMS and widely supported. They should be your default when hardware keys aren't available.

SMS is much better than nothing, despite its weaknesses. The realistic threat from SIM swapping is real but not universal. Don't avoid SMS 2FA because it's imperfect — the alternative of no second factor is considerably worse.

Three Things Worth Doing

Prioritize your most important accounts first. Your primary email is particularly critical — it controls password resets for nearly every other account. Your password manager and any financial accounts deserve the strongest 2FA you can enable. Work outward from there.

Save your recovery codes. When you enable 2FA, services typically offer one-time recovery codes for when you lose access to your second factor. Store these somewhere offline and secure. Losing your phone without recovery codes can permanently lock you out of critical accounts.

Combine 2FA with strong unique passwords. A password manager generating a unique password for every account plus an authenticator app is a substantial improvement over reused passwords alone, even if you never upgrade to hardware keys.

A Common Misconception

Biometric 2FA — using your fingerprint or face to approve a login — doesn't send your biometric data to the website. Modern implementations (WebAuthn) use the biometric locally on your device to unlock a cryptographic key. The website receives a signed cryptographic message, not your fingerprint. Your biometric data stays on your hardware.

The Bard's Take

Two-factor authentication doesn't make accounts impenetrable. Sufficiently determined attackers with the right access can still find ways in. What 2FA does is make the most common attacks — credential stuffing, phishing, data breach reuse — fail even when they partially succeed.

A stolen password should be a problem. With 2FA enabled, it's still a problem, but not necessarily the one the attacker needed. They also need whatever you have in your pocket, or what's cryptographically bound to your hardware. That second requirement, requiring different types of proof, is what the security is actually built on.

It takes about two minutes to enable. The next time a service you use has a data breach, those two minutes will have been well spent.

Sources

← Back to the Desk — Technology