What two-step verification is (2FA)
Two-step verification asks for two different proofs that it's you: your password and one more thing. It protects your account from anyone who only has the password, and it can lock you out if that "other thing" only lives on your phone.
- What it is
- Two proofs, not one
- Since
- 2011 (Google, to the public)
- Verdict
- Yes
What it is
Two-step verification, also called 2FA or two-factor authentication, requires two different proofs before letting you in: something you know (your password) and something you have or something you are (a code, a key, your fingerprint). If someone steals your password, they're still missing the second proof.
It's not the same as multi-factor authentication (MFA): MFA can ask for two, three or more proofs; 2FA always stays at exactly two. In practice, almost every service you use daily runs on 2FA: a password plus a code by SMS, an authenticator app, or a push notification to your phone.
Since when
Google made two-step verification public for all Google accounts on February 10, 2011, and expanded it to over 150 countries and 40 languages that same July. Since then, every other major service — banks, social networks, email — has added its own version, with similar names but different mechanics depending on the provider.
Why it's used
It protects against the most common reason an account gets stolen: a leaked or reused password. With 2FA, that password alone is no longer enough to log in.
The flip side is the one that matters to us: if that second step only exists on your phone — an SMS to that number, an app with no backup, a notification that only arrives there — you lose your phone and you also lose the key that was supposed to protect you. Two-step verification only really works if it also has an exit that doesn't depend on the same device.
Do we use it?
Yes, on your email, your password manager and your bank, always with an exit that isn't your phone. Without that exit, the protection can become the problem itself.
Check this
- Do you have two-step verification turned on for your main email?
- If your phone disappeared today, could you complete that second step another way?
- Do you know where your backup codes are, if you have them?
Official sources: Turn on two-step verification (Google) · What it is and how it helps (INCIBE)