Authenticator App

An authenticator app is a free app on your phone that shows a six-digit code, and the code changes every thirty seconds. After you type your password, the website asks for the number showing at that moment, and only the phone in your pocket can produce it. So a stolen password on its own is worth very little.

There is no magic in it. When you set it up, the site and the app agree on one long secret, usually when you scan a square pattern off the screen. Both then know the same secret and the same time, so both work out the same six digits, over and over. Nothing is ever sent to your phone, and that is the whole point. So the app still works on a plane, in a basement, or in a village where the signal disappears.

That also beats a code sent by text, which anyone standing beside you can read off your lock screen. Worse, a criminal can talk your mobile company into moving your number to their own SIM card, so every code arrives on their phone. Texts go missing for hours on a busy network too, just when you need one. None of this reaches an authenticator app, because there is no message for anyone to steal.

The usual mistake is switching it on in a hurry, because the screen that shows the setup square also shows a short list of backup codes. Save those somewhere that is not the phone, printed in a drawer or held in a password manager on your computer. Then put the app on a second device, or turn on its own encrypted backup, so a lost phone is an annoyance and not a disaster. Our entry on two-factor authentication explains the idea behind that second step. Linkysoft prints those codes with the client and locks them in the safe, because a photo on the same phone is not a backup.

If the phone is stolen and the backup codes were never saved, getting the account back can take days of proof, and sometimes it never works. Linkysoft has sat with owners locked out of their own company email over exactly that, when five minutes at setup would have avoided it. That is why every cybersecurity project starts by moving staff accounts to an app, since those accounts hold the customer data. Each person then signs in once from a second device before we go any further.