Two-factor sign-in, explained.
A stolen password alone no longer gets anyone in. The second proof is missing, and it sits on a device in your hand.
The idea behind it.
A password is something you know. Knowledge can be observed, guessed or stolen. That is why a second proof is added, from a different category: something you own, such as your phone or a small key fob, or something you are, such as your fingerprint. An attacker on the other side of the world can steal your password. They cannot steal your phone. That is exactly what the protection rests on.
The methods, from weak to strong.
Code by SMS: better than nothing
Widespread, but the weakest form. The number can be transferred to somebody else's card if they convince the mobile operator. This is called SIM swapping and happens more often than people assume. Use it where a service offers nothing else, but not by choice.
Code from an app: the sensible standard
An authenticator app produces a six-digit code every thirty seconds, from a secret agreed once between service and app during setup. Nothing travels over the mobile network. Usable offline, free of charge, on any phone. For the vast majority, the right choice.
Push confirmation: convenient, with one trap
You receive a notification on your phone and tap to confirm. Convenient, but attackers exploit it by sending requests until somebody agrees out of irritation. Good implementations therefore show a number that you have to recognise on the other screen.
Security keys and passkeys: the strongest
A small device on your keyring, or a key stored in your phone. They are bound to the address of the genuine service and simply do not work on a forged page. This is the only protection that holds even when the human makes the mistake.
Where the second factor does not help.
A code from the app does not stop you from entering it on a forged page. The attacker forwards it to the genuine service within seconds and is in. That is precisely why security keys and passkeys are stronger: they check the address themselves and refuse to work if it does not match. And a second factor does not help if your device itself has been taken over, because then the attacker sits behind both proofs. Two factors are a large step forward, but no substitute for an up-to-date device and a unique password.
Common questions. Clear answers.
Your question is not here? Write to us, we answer personally.
What does TOTP mean?
The abbreviation stands for time-based one-time password. Service and app share a secret and both derive the same code from the current time. That is why it changes every thirty seconds and why it works without an internet connection. If your clock is badly wrong, the codes stop matching.
What happens if I lose my phone?
That is why every service shows recovery codes during setup. Print them and file them with your important papers. Without them, the only route left is the support desk of the service in question, and that is laborious. A second factor already set up, such as a security key, helps as well.
May the second factor live in the same password manager?
Strictly speaking it weakens the separation, because both proofs sit behind one lock. In practice, though, the convenience is what makes people switch the second factor on at all, and in most cases that weighs more. For accounts that need particular protection, such as banking or email, a separate device is the better choice.
Is an authenticator app safer than SMS?
Yes, considerably. With the app nothing leaves the device, there is no mobile network in between and no number that somebody could take over. Where a service offers both, take the app. FidenoOTP is our app for this, with no account and no cloud.
Do I need two factors for personal accounts as well?
For three accounts, absolutely: your email inbox, your bank and your password manager. Almost every other account can be reset through the inbox, which makes it the master key. For all remaining services it is sensible but less urgent.
Enterprise Security. No Compromise.
Register for our next free, no-obligation live webinar and see how FidenoVault protects your logins.
- Zero-knowledge
- European sovereignty
- GDPR-compliant
