Two-factor authentication (2FA) requires a second proof of identity beyond your password. Microsoft reports that MFA blocks over 99.9% of automated account attacks. CISA lists MFA as one of its top cybersecurity priorities.
Types of 2FA: Best to Worst
🥇 Hardware Security Key (Best)
A physical key (Yubikey, Google Titan) you plug in or tap near your phone. Cannot be phished. Google reported zero successful phishing attacks on employees after mandating hardware keys.
🥈 Authenticator App (Strong — Recommended for Most)
Apps like Authy, Google Authenticator, or Microsoft Authenticator generate time-based 6-digit codes that change every 30 seconds. Strong protection against most attacks. Use Authy if you want encrypted cloud backup of your codes.
🥉 SMS Text Message (Acceptable, But Upgrade When Possible)
Better than no 2FA, but vulnerable to SIM-swap attacks where attackers convince your carrier to transfer your number. NIST no longer recommends SMS as a primary factor. Upgrade to an authenticator app where the option exists.
Where to Enable 2FA — Priority Order
🔴 Critical — Do Today
- Email (Gmail, Outlook) — controls password resets for everything else
- Online banking and investment accounts
- Password manager master account
🟡 High Priority — This Week
- Social media (Facebook, Instagram, LinkedIn, Twitter/X)
- Work accounts, VPNs, and remote access
- Cloud storage (Google Drive, Dropbox, iCloud)
🟢 Standard — This Month
- Shopping accounts (Amazon, PayPal, eBay)
- Gaming platforms (Steam, PlayStation, Xbox)
- Healthcare portals and pharmacy accounts
How to Set Up an Authenticator App
- Download Authy or Google Authenticator on your phone.
- Go to the security settings of the account you want to protect.
- Look for “Two-factor authentication”, “2FA”, or “Multi-factor authentication”.
- Choose “Authenticator app” rather than SMS.
- Scan the QR code shown on screen with your authenticator app.
- Enter the 6-digit code from the app to confirm setup.
- Save the backup codes provided — store them securely offline.
If you lose your phone without backup codes, you may be permanently locked out. Print them or write them down and store in a secure physical location separate from your phone.