What Is Two-Factor Authentication (2FA)?

What Does Two-Factor Authentication Mean?

Two-factor authentication (2FA) is a digital security measure designed around the premise that a single authenticating factor alone is not sufficient to access an online account; at least two factors are necessary. That’s why 2FA typically requires users to demonstrate a combination of something they know (typically a username and corresponding password), something they have (typically a tangible authenticating device), and/or something they are (like a fingerprint, retina, or facial recognition scan). An authenticating device may include anything from a USB drive to a simple code generated by a user’s mobile device.

Nowadays, all kinds of web applications — ranging from social media, to online banking, to cryptocurrency exchanges like Gemini — have enabled support for and recommend using 2FA for added account security.

Different Types of 2FA Security

• SMS: Many of the earlier and more rudimentary forms of 2FA rely on users inputting their mobile phone number to the login process of a platform in order to receive a time-based one-time password (TOTP) via text message (SMS). Despite the simplicity of this method, it can still be susceptible to vulnerabilities like SIM swaps and social engineering attacks. Other variations of SMS 2FA include phone call 2FA and email 2FA, which can share many similar vulnerabilities despite using different mediums. For this reason, most two-factor authentication best practice guidelines no longer recommend these methods. Different types of 2FA have emerged that are more secure alternatives to SMS-based TOTPs.

• Software-based: Dedicated two-factor authentication apps such as Authy, Okta Verify, and Google Authenticator generate time-based one-time passwords. These codes are unique to each connected service, and users must use the app every time they need to log in again. 2FA apps generate unique TOTPs for individual social media accounts, cryptocurrency exchange accounts, as well as any other additional connected accounts. Certain 2FA providers even allow users to control which devices can access their 2FA apps. By allowing only one device to access an authentication app, users can gain additional protection in the event they are the victim of a SIM-swap attack.

• Hardware-based: Another form of 2FA is a hardware security key, such as Yubikey, which you can plug in via USB. These keys provide a strong level of protection by delivering hardware-backed, cryptographic proof of your identity. They ensure that only the holder of the physical hardware key can gain access to an associated account, even if an attacker has compromised your password or successfully executed a SIM-swap attack on your mobile device. This mitigates many of the risks posed by phishing, person-in-the-middle, and replay attacks that rely on stolen passwords or one-time password (OTP) codes.

• Biometric: Perhaps the most secure and advanced form of two-factor authentication is biometric 2FA. This method requires specialized devices like cameras and scanners. Such devices were once prohibitively costly and complex, but biometric tools are increasingly being used on mobile phones with fingerprint scanners and facial recognition software.

The Best 2FA Method For You

There are a variety of two-factor authentication options that are readily available to consumers looking to further protect themselves online. It's difficult to say what the best 2FA app is, and each 2FA method comes with its own pros and cons. At a minimum, two-factor authentication combines two or more types of authentication for it to be considered 2FA. Ultimately it’s up to individual users to determine which security measures might best suit their own needs and security practices. Depending on the user, this might even involve multi-factor authentication (MFA), which can be configured to require three or more authentication factors for secure online authentication.

As with most measures of online security, two-factor authentication is a security practice in constant ebb and flow with the threats that it is designed to protect against. As security threats continue to become more advanced and nuanced, the best two-factor authentication apps and services — as well as authentication methods in general — will need to continue to evolve. This evolution might even include widespread adoption of blockchain 2FA applications and 2FA crypto protocols that leverage Distributed Ledger Technology (DLT) to enhance the security of the authentication process.