Two-Factor Login Is the Cash Machine Rule, Applied to Your Email
A card and a PIN have guarded cash for decades. The same idea now guards your accounts, and knowing which second factor you use matters more than whether you have one.
In short
What happened. Multi-factor authentication, often called two-factor, asks for two different kinds of proof before an account opens, and its use has grown.
What it means. A password alone can be guessed, leaked or tricked out of you. Adding something you have or something you are means a stolen password is no longer enough.
Risks and impact. It concerns anyone with an email, bank or social media account. Accounts with it switched on are much less likely to be taken over. It can still be bypassed through repeated login prompts, fake login pages and hijacked phone numbers, and codes sent by text message have known weaknesses.
What can be done. Check which second factor your main email account uses, and what the recovery route is if your phone goes missing. Never approve a login prompt you did not start.
What to watch. Whether the services you rely on offer an authenticator app or a hardware key, not only text-message codes.
Shown as a summary because of your reading settings.
What happened
Picture a cash machine. You push in a card and type a short PIN. Neither one alone produces a banknote. A thief with your card still needs the PIN. Someone who watched you type the PIN still needs the card.
That pairing is two-factor authentication in its oldest everyday form. The encyclopedia entry on multi-factor authentication (MFA) uses exactly this example. The rule is simple: a website or app lets you in only after you present two or more distinct types of evidence. If one is missing or wrong, the door stays shut.
There are three main types. Something you know: a password or a PIN. Something you have: a bank card, a key, a security token, or a phone that can be reached at a particular number. Something you are: a fingerprint, a face, a voice, even the rhythm of your typing. Some systems add a fourth signal, where you are. A login from inside an office network may be treated differently from one made remotely.
The important word is distinct. A card number plus the three-digit code on the back is two pieces of evidence. But both are things you know, or that anyone holding a photo of the card knows. The MFA article classes that as simple authentication, not two factors.
What the evidence supports
Where the sources agree: MFA use has grown, and accounts with it switched on are significantly less likely to be compromised. The passage we worked from gives no single percentage, so we will not invent one.
What the same source names as weak points: three routes around it, called fatigue attacks, phishing and SIM swapping. It also lists problems specific to codes sent by text message. Phones can be cloned. Apps can run on several phones. Maintenance staff at phone companies can read SMS texts. And a compromised phone is no longer something only you have.
Text codes are old technology by internet standards. The article traces the idea to 1996, when AT&T described a system for authorising transactions by exchanging codes over two-way pagers.
What these sources cannot tell us: how often each bypass happens, or how much safer an app or a hardware key is than a text code, in numbers. All three sources are Wikipedia articles, which summarise other work and can change. Treat them as a well-drawn map, not the ground itself.
How the story is being framed
“Any second factor beats none.” This is the practical view, and the source supports its core: an attacker who holds only your password is stopped. Its blind spot is comfort. People switch on text codes, feel finished, and never hear that the weakest version has known holes.
“Text codes are broken; use a hardware key.” This view takes the listed SMS weaknesses seriously. The MFA article notes that FIDO2 keys, backed by the FIDO Alliance and the W3C, have had mainstream browser support since 2015. What it leaves out is the cost the same article spells out. Physical tokens must be carried, can be lost or stolen, usually don’t scale across many accounts, and cost money to buy and replace.
“Security always costs convenience.” The MFA article says this almost word for word: there are unavoidable trade-offs between usability and security. Both camps above tend to forget it. The sensible middle ground is plain enough. The best second factor is the strongest one a person will actually keep using.
The background
Start with how an authenticator app works, because it looks like magic and isn’t. The app shows a short code that keeps changing. It is called a time-based one-time password, or TOTP. Your phone and the service both hold the same secret, which the article calls key material. Each side combines that secret with the current time and arrives at the same number. The secret itself never travels, and a code that leaks soon goes stale.
The comparison page lists two related methods. HOTP counts uses instead of time. Mobile-OTP is an older open-source system that mixes a PIN, the time and a secret stored on the device. It also splits apps into two families: standalone authenticators, and password managers with an authenticator built in. The second is convenient. It also puts both keys on one ring, which is worth a moment’s thought.
Hardware keys rest on the oldest principle of all. The MFA article notes that possession factors have been used for centuries as keys to locks. The key carries a secret shared with the lock. A software token on a phone can be copied. A dedicated hardware token cannot, short of physically breaking into it.
Now the three bypasses, in plain terms. In a fatigue attack, someone who already has your password triggers login prompts again and again, hoping you tap “approve” just to make them stop. In phishing, a fake login page asks for your password and your code, then passes both on at once. In SIM swapping, someone persuades a mobile operator to move your number to their card, and your text codes follow.
One common belief deserves correcting. A security question, such as your first pet’s name, is not a second factor. It is one more thing you know, the same type as the password.
The deeper story
The word authentication comes from the Greek authentikos, “real, genuine”, and from authentes, “author”. Underneath every login prompt sits a very old question: who is the author of this request?
Long before computers, people answered it three ways, the Authentication article explains. A credible witness could vouch for an object. An expert could compare its features with known originals. Or a document, such as a certificate, could attest to it. Each method could be faked. The son of Han van Meegeren, the well-known art forger, forged his father’s work and supplied a certificate of provenance to go with it.
So the defence was never perfection. It was economics. Forgery works only while faking costs less than it earns, and good authentication raises that cost. Two-factor login does nothing grander. It doesn’t make an account impossible to break into. It makes breaking in more trouble than most attackers will take.
Something quieter is going on too. Among people who know us, we are recognised by face and voice, the factor the engineers call “something you are”. Online, we prove ourselves through things we carry and things we remember, because a server has never met us. Most of us spend part of every day persuading machines that we are who we say we are.
Something to sit with
Which of your accounts would hurt most to lose, and do you know how it checks that you are you?
When did you last approve a login prompt without thinking about where it came from?
Try this today: open the security settings of your main email account and note which second factor it uses.
Sources
- Wikipedia — Multi-factor authentication — https://en.wikipedia.org/wiki/Multi-factor_authentication
- Wikipedia — Authentication — https://en.wikipedia.org/wiki/Authentication
- Wikipedia — Comparison of OTP applications — https://en.wikipedia.org/wiki/Comparison_of_OTP_applications
We report facts from the sources above in our own words and link to the originals. Interpretation is ours, not theirs.
Why is a card number plus the three-digit code on the back not two-factor authentication?
Two-factor means two different types of evidence. A card number and its code are both pieces of knowledge, which the MFA article classes as simple authentication.
♻︎ Free to republish
Copy this HTML into your CMS. Credit line and licence are included. Republish our work — free
Every headline has a deeper story. This is ours.
What we are doing here