Second Factor

When you log in to an online service, you have to prove that you really are the account holder. Usually a password is enough for that. But a password is only a single piece of proof – it can be guessed, spied on, or stolen when a provider’s database is breached. That’s why many services demand a second, independent piece of proof. That can be a six-digit numeric code that an app on your phone generates anew every 30 seconds. This additional piece of proof is called the second factor, and the whole procedure is called two-factor authentication.

What a stolen password is still worth then

Passwords are the weakest link in digital security. Every year, lists with billions of stolen login credentials show up online. Many people use the same password for multiple services. Attackers therefore automatically try out stolen combinations on hundreds of sites. This trick has its own name: credential stuffing.

A second factor defuses exactly this problem. The attacker may be sitting in another country and have your password. But he doesn’t have your phone. Without the code from the app, the door stays shut. Microsoft has reported multiple times that accounts with a second factor are taken over more than 99 percent less often.

That’s why the second factor is often no longer an optional choice these days. Banks in the EU must offer it for payments, because a directive called PSD2 requires it. Large platforms like GitHub or Google have made it mandatory for certain groups of users. Employers, too, almost always require it for company access.

Knowledge, possession, body: the three types of proof

Experts distinguish three categories of proof. First, something you know: a password or a PIN. Second, something you possess: a phone, a chip card, a small USB stick. Third, something you are: a fingerprint or a face scan. What matters is that the two factors come from different categories. Two passwords in a row are not a genuine second factor, because a single data theft can reveal both.

The most common variant today is an app like Google Authenticator or Aegis. When setting it up, you scan a QR code. This gives the app and the service the same secret starting value. From this secret and the current time, both sides independently calculate the same code. The code expires after a short time, so it is useless to an attacker later on.

Not every second factor is equally secure. Codes sent via SMS are considered weak, because criminals can have phone numbers rerouted to their own SIM card. App codes can also be intercepted if a fake login page tricks you into entering them. The most secure option is hardware keys based on the FIDO2 standard. They check which internet address they are logging in to, and refuse to respond to fake sites.

From bank login to passkey on your phone

In everyday life, you encounter the second factor most clearly with online banking. Every transfer has to be confirmed with a TAN from the banking app. It works similarly with Instagram, Steam, or your school account, as soon as you enable the feature in the security settings. Usually you also get backup codes there to print out. You should keep those – if your phone is lost, they are often the only way back into the account.

In news reports about hacking attacks, the second factor is almost always a topic. After the attack on the ride-hailing service Uber in 2022, it became known that an employee was so annoyed by dozens of push requests that he approved one. Such attacks are called MFA fatigue, meaning exhaustion caused by too many confirmation requests. They show: technology alone doesn’t protect you, the human remains part of the system.

Currently, the topic is shifting toward passkeys. Here, a cryptographic key stored on the device replaces the password entirely, released via fingerprint or face. So the proof isn’t split in two, but built completely differently from the ground up. Anyone familiar with the second factor will find this development easier to understand – it’s the same basic idea: a single stolen secret must not be enough.