'ZDNET Recommends': What exactly does it mean?
ZDNET's recommendations are based on many hours of testing, research, and comparison shopping. We gather data from the best available sources, including vendor and retailer listings as well as other relevant and independent reviews sites. And we pore over customer reviews to find out what matters to real people who already own and use the products and services we’re assessing.
When you click through from our site to a retailer and buy a product or service, we may earn affiliate commissions. This helps support our work, but does not affect what we cover or how, and it does not affect the price you pay. Neither ZDNET nor the author are compensated for these independent reviews. Indeed, we follow strict guidelines that ensure our editorial content is never influenced by advertisers.
ZDNET's editorial team writes on behalf of you, our reader. Our goal is to deliver the most accurate information and the most knowledgeable advice possible in order to help you make smarter buying decisions on tech gear and a wide array of products and services. Our editors thoroughly review and fact-check every article to ensure that our content meets the highest standards. If we have made an error or published misleading information, we will correct or clarify the article. If you see inaccuracies in our content, please report the mistake via this form.
You are one data breach away from having your entire online life turned upside down. The problem is passwords, which are hopelessly fragile ways to secure valuable resources.
Don't be lulled into a false sense of security by the belief that creating a longer, more complex, harder-to-guess password will somehow make you safer online. You can create a password that is so long and complex it takes you five minutes to type, and it will do nothing to protect you if the service where you use that password stores it improperly and then has their server breached. It regularly happens.
Also: Best VPNs • Best security keys • Best antivirus
And even with reasonable policies in place (complexity, changed regularly, not reused), people are still the weakest link in the security chain. Social engineering can convince even intelligent people to enter their credentials on a phishing site or give them up over the phone.
The solution is two-factor authentication, or 2FA. (Some services, being sticklers for detail, call it multi-factor authentication or two-step verification, but 2FA is the most widely used term, so that's the nomenclature I've chosen to use here.)
A 2019 report from Microsoft concluded that 2FA works, blocking 99.9% of automated attacks. If a service provider supports multi-factor authentication, Microsoft recommends using it, even if it's as simple as SMS-based one-time passwords. A separate 2019 report from Google offered similar conclusions.
In this article, I answer some of the most common questions people ask me about 2FA.
Turning on 2FA for a service changes the security requirements, forcing you to provide at least two proofs of identity when accessing a secure service for the first time on an unknown device. After you successfully meet that challenge, you usually have the option to categorize the device as trusted, which means that 2FA requests should be relatively rare on the devices you use regularly.
Those two forms of authentication can come from any combination of at least two of the following elements:
For the most part, the two-factor authentication systems you see in place today use the first item (your password) and the last item (your smartphone). Smartphones have become ubiquitous, making them ideal security devices.
Your smartphone can assist with authentication by providing a unique code that you use along with your password to sign in. You can acquire that code in one of two ways: Sent as a text message from the service, or generated by an app installed on your phone. (Some services also allow you to approve a push notification on your smartphone.)
The dialog box shown here, for example, is what I saw moments ago when I tried to sign in to my Gmail account from a browser I had never used before
If this sign-in request were from someone who had stolen my Google account credentials, they'd be stopped dead in their tracks. Without that code, they can't continue the sign-in process.
Most (but not all) services that support 2FA offer a choice of authentication methods. Google and Microsoft, for example, can both push notifications to a trusted device; you tap the notification to approve the sign-in. An increasing number of services support the use of hardware security keys (see: "YubiKey hands-on: Hardware-based 2FA is more secure, but watch out for these gotchas.")
And, of course, most services offer the option to print out backup recovery codes, which you can store in a safe place and use in the event your usual secondary authentication method is unavailable. If your smartphone is lost, stolen, or damaged, you'll need those codes.
The best authentication method is the one you're most comfortable with. Just make sure you have at least two options, to avoid the risk of being locked out of your account.
I prefer the option to use an authenticator app rather than receiving codes via text message whenever possible, and so should you, for two good reasons. The first is a matter of simple logistics. There are times when you have access to the internet (via a wired connection or Wi-Fi) but can't receive a text message, because your cellular signal is weak or nonexistent, or you're using a different SIM while traveling. The second is the small but real chance that an attacker will social-engineer their way through your mobile carrier's defenses to acquire a SIM card with your phone number, a process called "SIM-jacking."
The most popular 2FA app is Google Authenticator, which is available on iOS and Android. But there are plenty of alternatives; because the process for generating secure tokens is based on open standards, anyone can write an authenticator app that performs the same function. In fact, you can use multiple authenticator apps. I use Microsoft Authenticator, which is capable of receiving push notifications from personal and business accounts on Microsoft's platforms, as well as 1Password, which integrates 2FA support into the same app that manages passwords, making sign-in even more seamless. I also recommend the third-party app Authy, which allows you to manage authenticator codes on multiple devices with the ability to back up and restore account settings. (For details, see "Protect yourself: How to choose the right two-factor authenticator app.")
It's worth noting that setting up an account in your authenticator app only requires a data connection during the initial configuration. After that, everything happens on your device. The process is governed by a well-accepted standard that uses the Time-based One-Time Password algorithm (TOTP). That algorithm uses the authenticator app as a sophisticated calculator that generates codes using the current time on your device and the shared secret. The online service uses the same secret and its own timestamp to generate codes that it compares against your entry. Both sides of the connection can adjust for timezones without problem, although your codes will fail if the time on your device is wrong.
When I started writing about this technology a decade ago, 2FA support was relatively rare. Today, it's commonplace.
Google accounts, including both consumer Gmail and business Google Workspace accounts, offer a wide range of two-step verification alternatives. All Microsoft accounts, including the free accounts used with Outlook.com, Xbox, Skype, and other consumer services, support a variety of authentication options, as do the Azure Active Directory accounts used with Microsoft's business and enterprise services, including Microsoft 365 and Office 365.
2FA support is ubiquitous among social media services (Facebook, Twitter, Instagram, and so on). Every online storage service worth considering supports 2FA, as do most domain registrars and web hosting companies. If you're unsure about a specific service, the best place to check is a superb open source information repository called the Two Factor Auth List. And if a high-value service you rely on doesn't support 2FA, well, maybe you should consider switching to one that does.
You probably have login credentials at dozens of online services that support 2FA, so the best strategy is to make a prioritized list and work your way through it. I suggest these priorities:
Setting up additional security for most online services requires minimal technical skills. If you can use your smartphone's camera, type a six-digit number, and tap OK in a dialog box, you have all the skills required. The most difficult part of the job is finding the page that has the relevant settings.
If you're using SMS messages, all you need to do is associate a mobile phone number with your account. (You can also use a virtual phone line, such as a Google Voice number, that can receive SMS messages.) Configure the account to send a code to that number whenever you sign in on an untrusted device. For example, here's what this option looks like when enabled on a Twitter account:
Setting up 2FA on a Twitter account requires you to first re-enter your password and then enter the phone number where you want to receive authentication codes. After you complete that process, you'll receive a code on that device. Enter the code to confirm you received it, and the 2FA setup is complete. Helpfully, Twitter automatically generates a recovery code at the end of this setup process; print it out and file it in a safe place so you can recover in the event your primary 2FA method no longer works.
To get started with an authenticator app, you first need to install the app on the mobile device you want to use as your second authentication factor:
After you install the app for your device, the next step is to set it up to work with each account where you have enabled 2FA.
Also: Make your cloud safer: How to enable two-factor authentication for the most popular cloud services.
The setup process typically requires that you enter a shared secret (a long text string) using the mobile app. All of the mobile apps I listed above support using a smartphone camera to take a picture of a QR code, which contains the shared secret for your account. That's much easier than entering a complex alphanumeric string manually.
Here, for example, is the QR code you'll see when setting up a Dropbox account:
In your authenticator app. choose the option to add a new account, choose the bar code option, aim the smartphone at the bar code on your computer screen, and wait for the app to fill in the necessary fields.
After you set up the account in the authenticator app, it begins generating codes based on the shared secret and the current time. To complete the setup process, enter the current code from the authenticator app.
The next time you try to sign in with a new device or web browser, you'll need to enter the current code, as displayed by the authenticator app.
If you use older email apps that don't support modern authentication with an account that's protected by 2FA, your normal password won't work anymore. You'll need to generate special passwords for use exclusively with those apps. The security settings for your account should guide you through that process. (But really, if you are using an app that's so outdated it requires an app password, you should replace it with a modern alternative.)
As part of the 2FA setup process, you should also generate one or more recovery codes, which you can print out and store in a safe place. In the event your smartphone is lost or damaged, you can use those codes to regain access to your account.
If you use SMS text messages as a second factor for authentication, transferring your number to the new phone will seamlessly transfer your 2FA setup too.
Some authenticator apps allow you to generate codes on multiple devices. 1Password and Authy both fall into this category. Set up the app on the new phone, install the app, sign in, and then check each account to confirm that the codes generated on the new phone work properly. Microsoft Authenticator allows you to back up codes to the cloud and restore them on a new device. For instructions, see "Back up and recover account credentials in the Authenticator app."
For Google Authenticator and other no-frills apps, however, you'll need to manually re-create each account on the new device. Install the authenticator app on your new device and repeat the setup process for each account you used with your old phone. Setting up an account on a new authenticator app automatically disables codes generated by the old device.
Two-factor authentication will stop most casual attacks dead in their tracks. It's not perfect, though. A determined attacker who is directly targeting a specific account might be able to find ways to work around it, especially if they can hijack the email account used for recovery or redirect phone calls and SMS messages to a device they control. But if someone is that determined to break into your account, you have a bigger problem.
Any questions? Send me a note or leave a comment below.