Two-factor authentication: from SMS codes to hardware keys
A VPN is one layer. Password managers, 2FA, browsers, and encrypted communication — the full picture, budgeted realistically.
Why 2FA matters more than you think
Your password is already compromised. Maybe not today, maybe not for the account you're thinking about right now, but statistically, if you've been online for more than a few years, at least one of your passwords has been exposed in a breach. Have I Been Pwned lists over 13 billion compromised accounts at time of writing. That's why two-factor authentication isn't optional anymore—it's the difference between a leaked password being an inconvenience and losing access to your email, bank, or cloud storage.
Two-factor authentication (2FA) adds a second proof of identity beyond your password. Something you know (password) plus something you have (phone, security key) or something you are (fingerprint). Even if an attacker knows your password, they can't get in without that second factor.
The problem: not all 2FA methods are created equal. SMS codes are better than nothing, but they're vulnerable to SIM swapping attacks. Authenticator apps are significantly more secure. Hardware security keys are the gold standard but require upfront investment and a small learning curve. This chapter walks through each method, when to use what, and how to implement 2FA across your stack without losing access to your own accounts.
SMS codes: convenient but compromised
SMS-based 2FA sends a code to your phone number. You enter the password, then enter the six-digit code from the text. It's the most common form of 2FA because it requires zero setup beyond having a phone.
The vulnerability: SIM swapping. An attacker calls your mobile carrier, impersonates you using social engineering or leaked personal information, and convinces them to transfer your number to a new SIM card. Once they control your number, they receive your 2FA codes. This isn't theoretical—it's been used to compromise Twitter accounts, cryptocurrency wallets, and email accounts of high-profile targets and regular people alike.
When SMS 2FA makes sense:
- Low-risk accounts where it's the only 2FA option offered
- Services you access infrequently and don't want to manage in an authenticator app
- As a backup method (not primary) for account recovery
- Add a carrier PIN or passcode to your mobile account to prevent unauthorized SIM changes
- Use Google Voice or similar VOIP number for 2FA codes (not linked to your physical SIM)
- Enable any additional carrier security features—call your carrier and ask what fraud protections they offer
Authenticator apps: the practical middle ground
Authenticator apps generate time-based one-time passwords (TOTP) locally on your device. They don't require network access to work—the codes are generated using a shared secret exchanged when you first set up 2FA. No SIM card means no SIM swapping vulnerability.
How TOTP works: When you enable 2FA, the service shows a QR code. Scan it with your authenticator app. That QR code contains a secret key. Both the service and your app now share that key. Every 30 seconds, they each independently generate a new six-digit code using the same algorithm and the current time. When you enter the code from your app, the service verifies it matches what they generated. The codes expire quickly, so even if someone intercepts one, it's useless within seconds.
Recommended authenticator apps:
- Aegis (Android): Open-source, encrypted backups, no cloud sync (which is actually a feature—keeps codes off third-party servers)
- Raivo OTP (iOS): Open-source, encrypted iCloud backup optional
- 2FAS (cross-platform): Open-source, optional encrypted cloud backup
- Bitwarden (if you already use it as your password manager): Built-in TOTP generator available on paid plans
Setup process: 1. Enable 2FA on the service (usually in Security settings) 2. Choose "Authenticator app" or "TOTP" method 3. Scan QR code with your authenticator app 4. Service shows backup codes—save these immediately in your password manager 5. Enter the code from your app to confirm setup
Critical step everyone forgets: Save those backup codes. Services typically show 8-10 one-time backup codes when you enable 2FA. Store them in your password manager's notes field for that account. If you lose your phone or the authenticator app fails, these codes are your only way back in.
Managing multiple devices: If you use multiple phones or tablets, most authenticator apps let you export/import accounts. Aegis exports encrypted files. 2FAS syncs across devices if you enable that feature. Set this up before you need it—trying to recover 2FA codes after losing your primary device is exponentially harder.
The password manager integration question: Tools like 1Password and Bitwarden now offer built-in TOTP generation. This is controversial. It technically reduces your two factors to one (both password and 2FA code come from the same app). For most threat models, this tradeoff is acceptable—the convenience means you'll actually use 2FA on more accounts, and the primary risk (password database breach) is mitigated by the manager's encryption. For high-value accounts (email, financial), use a separate authenticator app.
Hardware security keys: maximum security, minimum friction
Hardware keys are physical devices—usually USB or NFC—that provide cryptographic proof of identity. Unlike codes that can be phished, hardware keys use public-key cryptography and verify the domain you're signing into. An attacker can't trick you into using your key on a fake login page because the key only works with the authentic domain.
Two main protocols:
- FIDO U2F: Older standard, still widely supported, works as second factor only
- FIDO2/WebAuthn: Can work as passwordless authentication (the key IS the login), widely adopted by modern services
- YubiKey 5 series: USB-A and USB-C versions, NFC support, around $50-70 depending on model at time of writing (check Yubico's website for current pricing)
- YubiKey Bio: Adds fingerprint sensor, higher price point
- Titan Security Key (Google): Budget option, USB-A/NFC or USB-C variants, check Google Store for current availability
Setup process (example with Google account): 1. Go to account security settings 2. Select "Security Key" under 2FA options 3. Insert key into USB port (or hold near device for NFC) 4. Press the button/touch sensor on the key when prompted 5. Name the key (e.g., "Primary YubiKey") 6. Repeat with backup key
Critical consideration: Not all services support hardware keys yet. Check compatibility before buying. At time of writing, major platforms with strong hardware key support include Google, Microsoft, Apple, Facebook, Twitter, GitHub, Bitwarden, and most major financial institutions. Many services support keys only as second factor alongside password, not as passwordless login yet.
Mobile device compatibility: Modern phones support NFC security keys. USB-C phones can use USB-C keys directly. iOS devices with Lightning ports require NFC keys. Test this before you need it—NFC positioning can be finicky the first few times.
The backup problem: If you use a hardware key as your only 2FA method and lose both primary and backup keys, you're locked out. Most services let you register multiple keys—do this. Some people keep a third key in a safe deposit box for critical accounts.
Building your 2FA strategy: which method for which account
Tier 1 - Hardware key (if supported):
- Email accounts (your recovery point for everything else)
- Password manager account
- Financial accounts (bank, investment, cryptocurrency)
- Cloud storage with sensitive data
- Work accounts with access to company systems
- Social media accounts
- Shopping accounts with saved payment info
- Cloud services (hosting, domains, VPN account)
- Any account that doesn't support hardware keys but offers TOTP
- Services that only offer SMS 2FA
- Backup method for Tier 1 and 2 accounts (but register hardware key and authenticator app first)
- Throwaway accounts for one-time use
- Accounts with no personal data or financial access
- Local application accounts that never touch the internet
Recovery planning: don't lock yourself out
The biggest 2FA failure mode isn't getting hacked—it's losing access to your own accounts because you didn't plan for device loss or authenticator app failure.
Backup code checklist:
- Store backup codes in your password manager immediately after enabling 2FA
- For accounts without backup codes, register multiple authentication methods (authenticator app + hardware key)
- Print physical copies of backup codes for critical accounts, store in secure location
- Test backup codes periodically—verify they actually work
- Phone lost/stolen → authenticator app codes gone
- Hardware key lost → no physical token
- Both lost → need backup codes or secondary registered authenticator/key
The email account problem: Your email is usually your account recovery method. If you lock yourself out of email, you can't reset passwords anywhere else. For your primary email account specifically:
- Use hardware key as primary 2FA
- Register backup hardware key stored separately
- Keep backup codes in physical secure location (safe, safety deposit box)
- Consider a recovery email at a different provider with its own 2FA setup
Implementation roadmap: doing this without going crazy
Enabling 2FA on every account in one weekend is a recipe for mistakes. Systematic approach:
Week 1 - Critical accounts:
- Primary email
- Password manager
- Bank accounts
- Any cryptocurrency wallets
- Backup email accounts
- Phone/mobile carrier account (to prevent SIM swapping)
- Cloud storage (Google Drive, iCloud, Dropbox)
- Secondary financial accounts (credit cards, payment processors)
- Major shopping accounts with saved payment info (Amazon, etc.)
- Subscription services with billing info
- Social media accounts
- Forums and communities
- Less critical services
- Save backup codes before moving to next account
- Test login with 2FA enabled (use private/incognito window while still logged in elsewhere)
- Document which 2FA method you used in password manager notes
The passkey future: what's changing
Passkeys are the next evolution—FIDO2/WebAuthn credentials that replace passwords entirely. Instead of password + 2FA, you have one cryptographic authentication using biometric or device PIN.
Apple, Google, and Microsoft are all pushing passkey adoption. Synced across devices in their respective ecosystems. At time of writing, passkey support is growing but still inconsistent across services.
Current state: You can use passkeys on some services (Google accounts, Microsoft accounts, GitHub, a growing list of websites), but you'll still need traditional 2FA for most accounts for the next few years.
Transition strategy: Enable passkeys where available, keep traditional 2FA in place elsewhere. Don't delete your password and 2FA for passkey-enabled accounts yet—many services still require password as backup, and cross-platform passkey sync has rough edges.
Key takeaways
- SMS 2FA is better than nothing but vulnerable to SIM swapping—use it only as backup or when no other option exists
- Authenticator apps (Aegis, Raivo, 2FAS) provide strong security for most accounts with minimal cost—install one and start using it this week
- Hardware security keys offer maximum protection against phishing and should be used for your most critical accounts (email, password manager, financial)
- Always save backup codes immediately after enabling 2FA—store them in your password manager or secure physical location
- Buy two hardware keys if going that route, register both as backups for each account to avoid lockout scenarios
- Implement 2FA systematically over several weeks, starting with email and password manager, testing each account after enabling to avoid locking yourself out