1.2Two-factor authentication (2FA / MFA)
The essentials in 30 seconds
- Best effort-to-protection ratio: 2FA blocks almost all account hijacks even when the password has leaked.
- Factor hierarchy: authenticator app > SMS, and physical key / passkey above everything.
- Email first + recovery codes: saved AT SETUP — after losing your phone, it is too late.
Threaded mini-case — Karim locks down his accounts in Algiers
Karim learns his old email password circulated after a leak. Luckily, he has just enabled two-factor authentication: the attacker, holding only the password, is stuck at the code. Karim installs an authenticator app on his phone, enables 2FA on his email then on his bank, work account and manager, and stores his recovery codes somewhere safe.
Sequel to case 1.1 — Karim protects the cleaned-up accounts with a second factor.
1. A second proof of identity
Two-factor authentication (2FA / MFA) is the security measure with the best effort-to-protection ratio. Once enabled, it blocks almost all account hijacks, even if your password was stolen.
Karim verifies it: his stolen password is no longer enough — without the second factor, the attacker stays locked out.
2. Not all factors are equal
SMS is acceptable but imperfect (SIM swapping, interception). The authenticator app is recommended. The FIDO2 physical key / passkey is the strongest level, phishing-proof.
Karim chooses the authenticator app for his email and keeps SMS only when he has no alternative.
3. Priority and recovery codes
Top priority: email, bank, work accounts, the password manager itself. Back up the recovery codes AT SETUP — after losing your phone, it is too late.
Karim prints his codes and stores them somewhere safe right at setup: losing his phone one day will not lock him out.
🔎 Concrete example — 🔎 Concrete example — The best effort-to-protection ratio
A few seconds against an avoided hijack.
2FA on EMAIL (security settings) → scan the QR.
Save recovery codes (printout or manager).
Continue: bank, work account, social networks, manager.
→ accounts survive password theftTakeaway: email first, because everything resets there.
Lesson: remembered trusted devices = minimal friction.
Section vocabulary
- 2FA / MFA
- A second proof of identity after the password: code, app, physical key — what saves you when the password leaks.
Simple example: The code Karim must provide after his password to open his email.
What it is not: a lone password, however long, with no second factor.
Reflex: enabled on email before everything else.
- Authenticator app
- An app generating temporary codes offline: safer than SMS.
Simple example: The app installed on Karim's phone to approve his logins.
What it is not: a code received by interceptable SMS.
Reflex: the recommended choice when no physical key is available.
- SMS code
- A code received by SMS: better than nothing, but vulnerable (SIM swapping, interception).
Simple example: The SMS code Karim only uses as a last resort.
What it is not: a phishing-proof physical key.
Reflex: SMS only if there is no alternative.
- Security key (FIDO2 / passkey)
- A physical key or passkey: the strongest authentication level, phishing-proof.
Simple example: The key Karim's company may provide for the most sensitive accounts.
What it is not: a secret question guessable from social networks.
Reflex: the level to request for critical accounts.
- Recovery codes
- Recovery codes provided at setup: the emergency exit if the phone is lost.
Simple example: The codes Karim prints and stores somewhere safe right at setup.
What it is not: codes never backed up, nowhere to be found after losing the phone.
Reflex: saved AT SETUP, not after.
In practice — In practice — Enable 2FA where it counts
- Install an authenticator app on your phone.
- Enable 2FA on your EMAIL first (account security settings): scan the QR code with the app.
- Back up the recovery codes offered (printout or password manager).
- Continue with critical accounts: bank, work account, social networks, the password manager itself.
Ready-to-say script — explain 2FA to a colleague (30 s)
“Enable two-factor authentication on your email first: install the app, scan the QR code, and store the recovery codes right away. A few seconds at each new login, and your stolen password is no longer enough to hijack you.”
Say in pairs; show the account security settings screen.
Copy-paste template — 2FA activation plan
APP INSTALLED: _______________
EMAIL 2FA [ ] on _______________ | RECOVERY CODES stored [ ] where _______________
BANK [ ] | WORK ACCOUNT [ ] | MANAGER [ ] | SOCIAL NETWORKS [ ]
FACTOR: app [ ] | SMS (fallback) [ ] | key / passkey [ ]Single phone
With only one phone: install the app on it AND back up recovery codes on paper somewhere safe — without them, losing the phone locks you out.
Office in Algiers
Karim enables 2FA on his work accounts with his IT's agreement: some company tools already enforce their second factor — never bypass it.
Friction-averse
Serious services remember trusted devices: the code is only asked at new logins — a few seconds against an avoided hijack.
Shared service account
If an account is shared: ask IT for a real solution (named accounts + key) instead of passing codes around — sharing cancels the protection.
✓ Best practices
- Email first.
- App over SMS.
- Codes saved at setup.
✗ Common pitfalls
- SMS when the app exists.
- Codes never backed up.
- 2FA forgotten on the manager.
Key takeaways
- 2FA blocks almost all account hijacks by stolen password.
- Top priority: email, bank, work accounts, password manager.
- Authenticator app > SMS; physical key/passkey above everything else.
- Back up recovery codes AT SETUP — after losing your phone, it is too late.
48h Challenge - apply tomorrow
Enable 2FA on your email (template above) with an authenticator app and store your recovery codes. 15 minutes is enough.
- I can cite the hierarchy (app > SMS, key above).
- I know why email comes first.
- I enabled 2FA + stored my recovery codes.
Frequently asked questions
Isn't 2FA annoying day to day?
Serious services remember trusted devices: the code is only asked at new logins. A few seconds of friction against an avoided hijack — the math is quick.
Can an attacker bypass 2FA?
Modern phishing kits can relay codes in real time — hence the superiority of passkeys/FIDO2 keys, immune to this diversion. Even relative, 2FA remains a massive step up from password alone.
Karim can enable a second factor. Which to choose first?