A Second Lock on the Door
A passphrase is one secret, and secrets leak. Two-factor authentication adds a second proof that a thief almost never has — but the second factors are not equal, and the strongest exists for a specific reason.
I have a password manager now and a different passphrase everywhere. Is that the whole job done?
Almost — one gap left. Every passphrase is a single secret, and single secrets leak: a breach, a lookalike login page, a glance over your shoulder. Two-factor authenticationTwo-factor authentication (2FA)A second proof of identity beyond your passphrase — usually a code or a hardware key — so a stolen passphrase alone cannot open your account. adds a second proof, so one leaked secret is no longer enough.
Which is exactly why I hate it. A password I can buy in a leak dump. The second factor I have to be there for, live — and most of the time I cannot.
Something you know, something you have
A passphrase is something you know. A second factor is something you have: a one-time code from an app on your phone, or a small hardware key in your pocket. To get in, an attacker now needs both — and while a passphrase can be stolen from a database a thousand miles away, the second factor has to be in their hand at the moment they try.
Your passphrase for a site turns up in a breach dump. You had two-factor enabled. What happens when an attacker tries it?
The three kinds, weakest to strongest
Not all second factors are equal. From weakest to strongest: a code by text message, a code from an authenticator app, and a hardware security key. They defend against different things, and the gap between them is not small.
SMS code -> phone number can be stolen (SIM swap); still beats nothing
App code (TOTP)-> no SIM to steal; a 6-digit code that changes every 30s
Hardware key -> a physical key bound to the real site; refuses impostors
- Line 1A text can be redirected by tricking your phone company into moving your number to the attacker's SIM. Better than no second factor, but the phone number is the weak link.
- Line 3A hardware key checks which site is asking before it answers, so it cannot be handed to a fake page — the one factor that stops real phishingPhishingTricking you into handing your credentials to an impostor — a fake login page or message that looks like the real thing..
The gap the strongest factor closes
An app code has one weakness: phishingPhishingTricking you into handing your credentials to an impostor — a fake login page or message that looks like the real thing.. A convincing fake login page can ask for your passphrase and the six-digit code, then type both into the real site within the thirty seconds the code is valid. A hardware key refuses this — it will only prove your identity to the genuine site, so a relayed code is worthless. If an account matters enough, that is the reason to carry one.
Which second factor best resists a convincing fake login page that captures whatever you type?
A single secret
- One passphrase between an attacker and everything
- Trusting that a leaked password will not be tried elsewhere
- Relying on a texted code, and a phone number anyone can socially engineerA second factor, chosen well
- Two-factor on your email first — it is the reset button for everything else
- An authenticator app as the everyday default, not SMS
- A hardware key for the accounts that hold real money or real power
- Backup codes stored somewhere offline, in case you lose the deviceMatch it to your threat modelThreat modelFour honest answers: what you are protecting, from whom, what happens if it fails, and how much trouble you will go to.: an app code stops the mass, automated attacks that catch most people; a hardware key stops the targeted one aimed at you specifically.
So the passphrase manager was step one, and this is step two — and the email account is the one to protect first.
Exactly. Email is where every "reset my password" link lands, so it is the master key. Two-factor there, ideally with a hardware key, and the whole chain gets much harder to break.
And it moves me from "I bought your password" to "I have to fool you in person, live." Most of the time, that is enough to make me go elsewhere.
Legal
Enabling strong authentication on your own accounts is straightforward self-defence. Using these same ideas in reverse — SIM-swapping a number, standing up a fake login page — to reach someone else's account is unauthorised access, and it is exactly the attack the second factor exists to defeat.
So a second factor turns one leaked secret from a break-in into a dead end — and the factor you choose decides which attacks it stops. An app for the everyday, a hardware key for what matters most, and email protected before anything else. Next: keeping the separate identities you make actually separate — compartmentalisation, and the discipline the walls depend on.