What is two-factor authentication and why does it protect your accounts?

Published on 2026-10-20 by frfrand

2FA y MFA explicados: códigos TOTP, SMS, passkeys, claves físicas, recuperación y qué métodos resisten mejor el phishing.

Two-factor authentication (2FA) adds an additional check when logging in so that a stolen password is not enough on its own. It is one of the most practical measures to protect email accounts, cloud services, and administration tools.

But not all second factors offer the same security. Understanding the differences prevents placing too much trust in a six-digit code.

The example of the two keys

Imagine that to enter a building you need a key and a personal card. If someone manages to copy one of the two, they still lack another check.

In computing we talk about factors such as something you know (a password), something you have (a device or a physical key) and something you are (certain biometric data).

MFA means multi-factor authentication: two or more distinct factors. 2FA is the case of exactly two factors. Asking for two different passwords is not enough, because both belong to the same type of factor.

What types of second factor exist?

SMS codes. They are easy to use and are usually better than relying only on a password, but they can be affected by attacks on the telephone line, interception, or deception.

Authenticator apps. They generate temporary codes, frequently based on TOTP, even without receiving an SMS. It is important to protect the device and keep recovery mechanisms.

Approval notifications. Some applications ask you to confirm login from a phone. You must avoid approving requests you did not initiate; fatigue attacks can take advantage of the habit of tapping "Accept".

Security keys and passkeys. Mechanisms based on FIDO2/WebAuthn can link authentication to the legitimate site, offering significant resistance against certain forms of phishing.

Does a TOTP code protect me against any phishing?

No. Imagine you enter a fake page that imitates your provider. The attacker could ask you first for the password and then for the temporary code, using both immediately against the real site.

Temporary codes increase security, but they are not necessarily phishing-resistant. Cryptographic methods linked to the domain, such as WebAuthn, offer different properties.

What is a passkey?

A passkey allows you to authenticate using public-key cryptography and a compatible device or manager. It is usually activated via biometrics or a local PIN.

This does not mean the site receives your fingerprint. Biometric verification, when used, typically unlocks a protected key on your device; the server verifies a cryptographic proof.

Passkeys can sync between devices or be stored on physical keys, depending on the provider and configuration. That is why it is advisable to prepare recovery methods.

What happens if you lose your phone?

This is the point many people discover too late. Before enabling MFA, check what recovery options the service offers: backup codes, additional keys, or secondary devices.

Store recovery codes in a safe place separate from the main password. Having everything in the same screenshot inside a shared folder is not a good strategy.

If a company uses critical accounts, it is advisable to document who can recover access and how identity will be verified without opening an informal backdoor.

Three common mistakes

Thinking any 2FA is invulnerable. Methods vary greatly in resistance and ease of recovery.

Sharing a code because support asks for it. Temporary codes are authentication secrets; an unexpected request deserves distrust.

Not reviewing active sessions. Enabling MFA does not always close old sessions that were already authenticated. After an incident, it may be necessary to close sessions and rotate keys or tokens.

Where is it best to enable it first?

Prioritize email, password managers, code repositories, infrastructure, financial services, and accounts that allow recovering access to others.

Email is especially important: whoever controls that account may attempt to reset passwords for many related services.

And ArduMaker accounts?

As with any platform from which VPS and services are managed, protecting ArduMaker access credentials is important. Use the authentication and permission mechanisms actually available for your account and avoid sharing administrative credentials. It is not advisable to assume that a specific MFA function is enabled without checking the platform configuration.

In summary: 2FA reduces the risk associated with a stolen password; phishing-resistant methods offer additional protection. Choose a mechanism that you can maintain and recover securely.

Technical source: NIST: authenticators and phishing resistance · What is phishing.