Two-Factor Authentication

When you log in to an online service, you usually have to prove that you really are the account holder. Most often this happens with a password. But a password has one weakness: whoever knows it can get in. Two-factor login therefore requires a second, independent proof. This can be a six-digit numeric code that appears on your phone and becomes invalid after 30 seconds. Only the password and the code together unlock the account. The principle resembles an ATM: the card alone is not enough, and the PIN alone is not enough either.

What a stolen password is still worth then

Passwords are stolen constantly. Sometimes entire customer databases of companies are copied and sold on the internet. Sometimes someone types their password into a fake login page that looks almost identical to a real one. Such deception attempts are called phishing. Millions of login credentials have already ended up in the wrong hands this way.

With a second factor, a stolen password is worthless on its own. The attacker might be sitting in another country and doesn’t have your phone. Large providers report that a second factor stops the vast majority of automated attacks on accounts. That is why banks in the EU are now legally required to use two factors for online payments.

However, a second factor does not replace a good password. It is an additional hurdle, not a substitute for carelessness. Anyone who uses the same weak password everywhere still has a problem — for example, with services that lack a second factor.

Knowledge, possession, and biometric trait as the three categories

Experts distinguish three types of proof. First, something you know: a password or PIN. Second, something you possess: a phone, a small USB plug acting as a security key, a bank card. Third, something you are: a fingerprint or face. What matters is that the two factors come from different categories. Two passwords entered one after the other are not a two-factor method.

The most common approach is rotating numeric codes. An app on the phone and the server share a common secret, usually transmitted via QR code during setup. From this secret and the current time, both independently calculate the same code. This is why the app does not need an internet connection, and why the code expires after a short time.

Not all methods are equally secure. Codes sent via SMS are considered the weakest variant, because criminals can have phone numbers transferred to other people’s SIM cards. An app code can also be stolen if the victim types it into a fake page. A physical security key, on the other hand, checks for itself whether the website is genuine, thereby also protecting against phishing.

From banking apps to passkey login

You encounter this method constantly in everyday life. A transfer in online banking usually has to be approved in a second app on your phone. On Instagram, Steam, or your school account, you can turn on 2FA in the security settings. There you also get backup codes to print out — important in case your phone gets lost.

In news reports about hacker attacks on companies, the lack of two-factor login is a recurring theme. Often a single access point without a second factor was enough to get into a company network. Many cyber insurance policies now require proof that all employee accounts are protected.

Currently, the technology is shifting toward passkeys. Here, a cryptographic key stored on the device replaces the password, unlocked via fingerprint or face scan. Possession of the device and a biometric trait are then combined into a single login step. The detour of typing in a code is eliminated — but the underlying principle of two independent proofs remains intact.