How to use two-factor authentication to lock down your accounts the right way

The best 2FA methods don’t depend ona phone number. Here’s what to use instead.

- JARED NEWMAN

Ready or not, two-factor R authentication (fave.co/3co510T) is something you'll need to start thinking more about.

This approach to online security, also known as two-step authentication, multifactor authentication, or just 2FA for short, involves combining a regular password with a secondary numeric code, which you must enter on any device where you haven't logged in before. This extra code typically gets sent to your phone, so someone who steals your password can't get into your account unless they have physical access to your phone as well (and know how to unlock it).

The added annoyance of 2FA is well worth the extra security it provides, which is why some tech companies have now started requiring it. Google (fave.co/3Vbq5vy) and Amazon’s Ring (fave.co/3Wfom9W) both made 2FA mandatory last year, and it’s on by default for most Apple IDs (fave.co/3G8FCIt). I’ve also noticed Amazon selectively enforcing 2FA on it apps and website, sending a link to click on via text message when you login on a new device.

While these are all positive steps, the smartest approach to 2FA isn’t merely passive. Many of these 2FA methods work by texting a code to your phone, which is better than nothing but is susceptible to potentially devastating SIM hijacking attacks (fave.co/3WbHZ2N). (The FCC is only now starting to examine that problem; fave. co/3YwAZ25.) And if your phone gets lost or stolen, you’ll want to have a backup 2FA method at the ready.

If you’re ready to take 2FA more seriously, here are some options to consider:

USE AN AUTHENTICATOR APP