2FA: from SMS to passkeys
Lesson 5 of 16 in the course “Cybersecurity from Scratch”. Free, with animations and a quiz.
A second lock on the door
Two-factor authentication (2FA) means that besides a password you need something else: a code, a prompt on your phone or a key. If the password leaks, the door stays shut. In Google’s 2019 study even an SMS code stopped all bot attacks and 96% of bulk phishing. But against targeted attacks the gap is huge: SMS 76%, an on-device prompt 90%, a security key 100%.
The weak spot of SMS
In January 2024 the X account of the SEC, the US financial regulator, was hijacked. Scammers talked the mobile carrier into moving the SEC’s number to their SIM card. That’s a SIM swap. 2FA on the account was off, the password was reset via the number, and a fake post about bitcoin ETF approval went out. Even SMS codes wouldn’t have helped: they’d have gone to the scammers. An authenticator app or a key protects you.
The ladder, from worst to best
No 2FA: one password is enough. SMS: better than nothing, but the code can be intercepted with a SIM swap or tricked out of you by phishing. An authenticator app (Google Authenticator, Microsoft Authenticator and similar) generates a code on your phone every 30 seconds; the carrier can’t intercept it. But you can still type it into a fake site. Be careful with push prompts: in 2022 the attacker who hit Uber spammed an employee with requests until they tapped “Yes”.
Passkeys: a password that can’t be phished
A passkey is an access key used instead of a password. Your phone or laptop keeps the secret part of the key and confirms the login with your fingerprint or face. The key is tied to the exact site address, so on binance-verify.com it won’t work, even if you yourself believed the design. A hardware security key, a small USB device like a YubiKey, works the same way. Google, Apple, Microsoft and many exchanges, Binance included, support passkeys. Wherever you can, pick one.
What Dan turns on today
Email: a passkey, with an authenticator app as the backup method. Exchange: a passkey instead of SMS. Password manager: an authenticator app. Dan removes his phone number as a login method wherever there’s something better. And he saves backup codes on paper at home right away: if his phone drowns, without them he could lose access for good. In the trainer, rank the 2FA methods by strength.
Check yourself
- Why is an SMS code the weakest kind of 2FA?
Correct answer: The number can be taken with a SIM swap, and the codes go to the scammer. The code is tied to a number, and the number to a carrier that can be fooled. That’s how the SEC account was hijacked in 2024. - At night Dan gets a tenth “Is this you signing in?” prompt while he’s in bed. What should he do?
Correct answer: Tap “No” and change the password right away: someone knows it. The prompts mean someone already has the password. The second factor holds the door, but don’t make it hold forever: change the password. - Why does a passkey protect you even from a perfect copy of a site?
Correct answer: The key is tied to the exact site address and won’t work on another one. You might believe a fake, the key won’t: it checks the address itself instead of looking at the design.
← A password manager: remember just one Email and phone number: the master keys →