crackthe.net
Two-factor authentication: which method and where first
A second factor means a stolen password is not enough on its own. Not all methods are equal though – and the differences matter most exactly where your money is.
- Never approve a prompt you did not start yourself.
- Change that password immediately – someone already has it.
- End all active sessions on the account.
- Switch to a stronger second factor than push or SMS if the service offers one.
Two-factor authentication adds a second proof beyond the password. Its value is simple: the credential-stuffing attacks that drive most account takeovers stop working, because a leaked password alone no longer opens the door.
The methods, honestly ranked
| Method | Protection | Notes |
|---|---|---|
| Security key / passkey | strongest | Verifies the domain, so fake login pages cannot capture it |
| Authenticator app (TOTP) | strong | Codes generated on your device, works offline |
| Push approval | medium | Convenient, but vulnerable to approval fatigue |
| SMS code | weakest of the four | Can be redirected by taking over your phone number |
| No second factor | none | A leaked password is all an attacker needs |
Where to enable it first
Order matters, because one account unlocks the others:
- Email – the master key. Reset links for everything else land here.
- Banking and payment services.
- Password manager itself.
- Cloud storage holding documents and photos.
- Social media and shopping accounts.
Passkeys, in one paragraph
A passkey replaces the password entirely: your device proves who you are with a stored cryptographic key, unlocked by your fingerprint, face or device PIN. Because the key is bound to the genuine web address, a fake login page never receives anything usable. Where a service offers passkeys, they are both the most convenient and the most phishing-resistant option available.
Setting it up without locking yourself out
- Generate recovery codes the moment you enable 2FA – every service offers them.
- Store them offline: printed, or in your password manager’s secure notes.
- Register a second method where possible, such as a backup key or a second device.
- Check before wiping a phone that your authenticator entries are transferred first.
- Do not screenshot codes into a photo library that syncs to the cloud.
The most common self-inflicted problem
Far more people lose access through a lost phone with no recovery codes than through an attack. Two minutes spent saving those codes when you switch 2FA on is the difference between a minor inconvenience and a permanently locked account.Approval fatigue
If an attacker has your password, some will simply trigger login prompts repeatedly, at night, until someone taps “allow” to make it stop. Treat any unrequested prompt as proof that your password is compromised: deny it, change the password, end all sessions – and if the service allows, move from push approval to a code or a key.
Next steps
- Password managers explained – the other half of the pair.
- Check active sessions – confirm nobody else is still logged in.
- Account hacked – if the prompts mean someone is already trying.
Frequently asked questions
Is SMS-based 2FA worthless?
No – it is much better than nothing and worth enabling if it is the only option. It is simply the weakest of the options, because a number can be redirected to an attacker’s SIM. For email, banking and anything holding money, prefer an app, a passkey or a security key.
What happens if I lose my phone?
That is what recovery codes are for. Generate them when you switch 2FA on, store them offline, and register a second method where the service allows it. Without either, a lost phone can permanently lock you out.
I keep getting login prompts I did not trigger. What does that mean?
Someone has your password and is trying to get in. Never approve the prompt. Change that password immediately and check for active sessions you do not recognize.