Two-factor authentication, often called 2FA, protects an account by requiring two different kinds of proof before login is allowed. A password is only one factor, so a stolen password by itself should not be enough to open the account. This matters because phishing, data breaches, and weak passwords can expose login information.
2FA makes the attacker also pass a second check, such as a code from a phone or a physical security key.
Understanding How Two-Factor Authentication Works
When a login begins, the website usually checks the password without storing the password itself. It stores a transformed version called a hash. A random value called a salt is normally included before hashing, so identical passwords do not create identical stored results.
The server transforms the entered password in the same way and compares the results. If they match, the system moves to the next check. This process reduces harm if a database is stolen, though weak passwords can still be cracked from their hashes.
A code from an authenticator app is usually made from a secret value shared by the app and the service. The secret is often placed into the app when the user scans a setup image. Both sides combine that secret with the current time to produce the same short code.
The code changes often because each time period produces a new result. The server may accept codes from a nearby time period when a phone clock is slightly wrong. The code is not normally sent from the app to the service until the user types it during login.
Not every second check gives the same protection. Text message codes can help, but phone numbers can be moved to a criminal's SIM card through account fraud. Push notifications can be abused when an attacker sends many approval requests and waits for a tired user to accept one.
A security key is often stronger against fake websites. The browser checks the website address before asking the key to approve a login. The key creates a response tied to that real address, so a copied login page at a different address cannot use the response successfully.
Recovery is one of the most important parts of account security. A person can lose a phone, change numbers, or damage a security key. Services therefore offer backup codes, recovery contacts, or identity checks.
Each recovery method becomes another possible route into the account. Backup codes deserve careful handling because someone who finds one may not need the normal device.
Keeping them on paper in a safe place or in a protected password manager is safer than leaving them in an ordinary screenshot folder or email inbox. Users should remove old devices and review active sessions after replacing a phone.
When learning about 2FA, pay attention to whether the two checks are truly separate. A password plus a code sent to the same poorly protected email account may not give much extra protection. The benefit is greatest when an attacker must defeat two independent barriers.
It is useful to think about realistic attacks rather than only random guessing. Phishing can trick people into entering a current code, while malware may steal browser sessions after a successful login. Good security involves the method, the recovery plan, careful checking of website addresses, and prompt action when a device or password may be compromised.
Key Facts
- 2FA requires two different factors: something you know, something you have, or something you are.
- Authentication decision: access is allowed only if factor 1 = valid and factor 2 = valid.
- A time-based one-time password usually changes every 30 seconds.
- Security keys often use public key cryptography, where the server stores a public key and the device keeps a private key.
- If a password has probability P1 of being guessed and a code has probability P2 of being guessed, combined guessing probability is approximately P = P1 × P2.
- Backup codes should be stored offline because they can bypass the normal second-factor device.
Vocabulary
- Authentication
- Authentication is the process of proving that a user or device is who it claims to be.
- Factor
- A factor is a type of evidence used to verify identity, such as a password, phone, fingerprint, or security key.
- One-time password
- A one-time password is a short code that is valid for only one login attempt or a short time period.
- Phishing
- Phishing is a trick that tries to make users reveal private login information on a fake or misleading page.
- Public key cryptography
- Public key cryptography uses a public key for verification and a private key that stays secret on the user's device.
Common Mistakes to Avoid
- Treating 2FA as just a second password is wrong because the second factor should come from a different category, such as a device or biometric check.
- Entering a 2FA code on any page that asks for it is unsafe because phishing sites can capture codes and use them quickly.
- Storing backup codes in the same email account they protect is risky because an attacker who gets into the email may also find the recovery codes.
- Assuming SMS codes are the strongest option is incorrect because phone numbers can be stolen through SIM swapping or intercepted in some attacks.
Practice Questions
- 1 A login password has a 1 in 100,000 chance of being guessed, and a 6-digit code has a 1 in 1,000,000 chance of being guessed. Assuming independent guesses, what is the chance an attacker guesses both?
- 2 A time-based one-time password changes every 30 seconds. How many different code windows occur in 10 minutes?
- 3 Explain why a hardware security key can protect against many phishing attacks better than a typed verification code.