Password isn’t enough. 2FA is the best protection against account theft.
What Is 2FA¶
Something you know (password) + something you have (phone, HW key). Even if someone gets your password, they can’t log in without the second factor.
Methods (Most to Least Secure)¶
- Hardware key (YubiKey) — most resistant to phishing
- TOTP app (Authy, Aegis) — 6-digit code, offline
- Push notifications (Microsoft Authenticator) — convenient
- SMS — better than nothing, but SIM swap risk
Where to Enable 2FA¶
- Email (HIGHEST priority!)
- GitHub / GitLab
- Cloud accounts (AWS, Azure, GCP)
- Banking
- Social networks
- Password manager (meta-security)
Backup Codes¶
ALWAYS save backup/recovery codes. Without them you’ll lose access when you lose your phone. Store them in password manager or print them.
Minimum¶
TOTP app (Authy) on email + GitHub + cloud. YubiKey for paranoids. SMS only as last resort.
2famfasecurity