Authenticator App

An authenticator app is a free app on your phone that shows a six-digit code. The code changes every thirty seconds. After you type your password, the website asks for that number, and only the phone in your pocket can produce it. A stolen password on its own is then worth very little.

There is no magic in it. During setup, the site and the app agree on one long secret, usually by scanning a square pattern on the screen. Both then know the same secret and the same time, and both work out the same six digits from those two things, over and over. Nothing travels to your phone, which is the whole point. The app still works on a plane, in a basement, or in a village where the signal disappears.

That is also why it beats codes sent by text. A text can be read on a lock screen by whoever is standing beside you. Worse, a criminal can talk your mobile company into moving your number onto their own SIM card, and every code then arrives on their phone instead of yours. Messages also go missing for hours on busy networks. None of this touches an app, because there is no message to steal.

The mistake is switching it on in a hurry. When a site shows you the setup square, it also shows a short list of backup codes. Save those somewhere that is not the phone, printed in a drawer or in a password manager on your computer. Then add the app to a second device, or turn on the app's own encrypted backup, so a lost phone is an annoyance and not a disaster. Our entry on two-factor authentication explains the idea behind the second step. Linkysoft prints those backup codes with the client and puts them in the safe, because a photo kept on the same phone is not a backup.

If the phone is stolen and the backup codes were never saved, getting an account back can take days of proof, and sometimes it never works. Linkysoft has sat with owners locked out of their own company email over exactly this. Five minutes at setup avoids it. In every cybersecurity project we move staff accounts to an app first, because those accounts hold the customer data, and each person signs in once from a second device before we go on.