What is two-factor authentication?

Two-factor authentication uses two different kinds of evidence when accessing an account. A known password, a possessed device and a biometric characteristic represent different factor categories. Requesting a second password does not necessarily provide a different factor.

How do codes, notifications and security keys work?

One-time codes may be generated by an application or sent in a message. Push methods request approval on a registered device. Hardware security keys and suitable passkey arrangements can use cryptographic authentication. Methods differ in phishing resistance: a code entered into a fake page can be relayed to the real service. SMS is exposed to risks involving the phone number. Unexpected approvals should not be accepted, and codes should not be disclosed to supposed support staff. Weak recovery procedures can undermine a strong sign-in method.

How should recovery and daily use be planned?

When enabling a second factor, establish how to recover after losing a device. Keep recovery codes securely; storing the only copy somewhere requiring the same locked account can create circular dependency. Review methods and sessions when changing devices. Multifactor authentication does not alone fix stolen sessions, compromised endpoints or excessive privileges. Available methods and accessibility needs should both be considered. The aim is not simply an extra step, but making a leaked password insufficient for an attacker.