Two-Factor Authentication 2FA

Two-factor authentication is a sign-in that asks for two different kinds of proof. The first is your password, which is something you know, and the second is something you are holding. That can be a code from an app on your phone, a small key you plug into the computer, or a message sent to your own number. Because the full name is a mouthful, most people shorten it to 2FA.

The reason it matters is simple, because passwords are stolen in bulk from companies you have never heard of. The old lists are still being sold years later, so if you used the same password twice, one leak opens both doors. With a second proof switched on, though, a thief in another country can type your correct password and still stop dead at the next screen. Your phone is in your pocket, not in his.

Not every second proof is equally strong, and this is where people get it wrong. A code sent by text message is far better than nothing, but it is still the weakest kind. A thief can talk your mobile operator into moving your number onto a new SIM card, so the codes arrive on his phone instead of yours. It tends to happen on a Friday evening, when the branch that could stop it has already closed. A code from an app, or a small key you plug in, cannot be taken away like that.

Two things go wrong in real life, and the first is losing the phone. So print the recovery codes the service gives you when you switch 2FA on, and keep them at home with your other papers. The second is the phone call, where someone rings, says they are from the bank and asks you to read out the code that just arrived. No real company ever asks for that, because the call itself is the attack. A ten-minute staff briefing about it is the cheapest part of any cybersecurity project Linkysoft runs.

For a business, the useful move is to make it compulsory on the accounts that see money or personal records, rather than on everything at once. Start with email, because the password resets for everything else arrive there. In a clinic system such as DocMz that means every account that opens a patient file. In a custom web application Linkysoft builds it is a setting the owner controls, not a choice each member of staff makes.