Two-factor authentication: the types and which to choose
SMS, app, push notification and physical key. Not every second factor protects equally.
Two-factor authentication asks for something besides the password to grant access. Even if the password leaks, an attacker still needs the second factor. The types vary a lot in how much they protect.
SMS code
Better than nothing, but the weakest. SIM-swap scams can redirect your messages.
Authenticator app
Generates codes that change every 30 seconds on the phone itself, without depending on the carrier.
Device notification
Convenient: you just approve the login. Be wary of requests you didn't make and never approve on impulse.
Security key and passkey
The strongest option. It works through cryptography tied to the real site, which blocks fake login pages.
Start with your main email, then banking, social networks and stores with a saved card. In a few minutes, your most important accounts become much harder to break into.
