Contact
What are you interested in?
Two-Factor Authentication (2FA).
Two-factor authentication (2FA) is a login method that requires a second, independent proof in addition to the password — such as a code from an authenticator app, a confirmation on the smartphone or a security key. A stolen password on its own is then no longer enough to get in.
Two-Factor Authentication (2FA) — Explained in Detail
Authentication rests on three kinds of factor: something you know (password, PIN), something you have (smartphone, security key) and something you are (fingerprint, face). 2FA combines two different kinds. An attacker who knows a password from a data breach or a phishing email fails at the second factor, unless they also have the victim's device.
The methods differ in security and convenience. SMS codes are widespread but the weakest, because text messages can be redirected or intercepted through a SIM swap. Codes from authenticator apps (TOTP, such as Microsoft or Google Authenticator) are considerably more secure. Push confirmations are convenient but tempt people to approve thoughtlessly when attackers send many requests. Security keys and passkeys offer the strongest protection, because they are additionally bound to the genuine domain.
For SMEs, 2FA is one of the most effective and cheapest protective measures of all. It should be active at least on every account through which a lot of damage can be done: email (Microsoft 365, Google Workspace), domain registrar and DNS, hosting, website administration, online shop, accounting, banking, advertising accounts with Google and Meta, and password managers. A hijacked email account is especially dangerous, because it can be used to reset the passwords of every other service.
For 2FA to work in everyday life, a little organisation is needed: store recovery codes securely, have at least two authorised people for important accounts, and switch the factors over when an employee leaves. Without this preparation, a lost phone quickly locks you out of your own accounts.
Example: a hijacked advertising account
An employee at a furniture shop enters her password on a fake login page that looks like Meta. Without 2FA, the attackers take over the advertising account and use the stored credit card to run ads for other people's products. With 2FA via an authenticator app, the password alone would have been worthless.
On websites and portals we build, secured admin access is standard, see web development. On existing websites we check access in the website audit.
Related Page
PasskeyIn-depth on the blog
Backups und AusfallsicherheitFrequently Asked Questions About Two-Factor Authentication (2FA)
Better than no 2FA at all, but the weakest method. Text messages can be redirected or intercepted through a SIM swap. Authenticator apps, security keys or passkeys are considerably more secure.
MFA (multi-factor authentication) is the umbrella term for methods with at least two factors. 2FA is the most common case, with exactly two factors.
Sign in with the recovery codes saved during set-up and set up 2FA again on the new device. That is why these codes belong somewhere safe, for example in a password manager or printed out in a safe.
More Terms Starting with "Z"
Ready for Your Project?
Apply this knowledge to your website — DLM Digital will help you.