Choosing a two-factor method
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 6 min
In short
Not all second factors are equal. SMS is vulnerable to phone-number takeover (SIM swapping), an authenticator app is stronger, and a hardware security key also resists phishing. On your exchange and your email, use the strongest method available.
Key points
- SMS codes can be taken via a SIM swap — move off it wherever you can
- An authenticator app (TOTP) generates the code on your device, so a hijacked phone number does not help an attacker
- A hardware security key checks the site's domain, so it simply will not work on a fake one
- Store the backup codes issued at setup safely and offline
Definition
Requiring a second proof in addition to a password — via an SMS code, a time-based one-time code from an authenticator app (TOTP), or a hardware security key (FIDO2/WebAuthn).
Talking about two-factor authentication as merely on or off hides the differences between methods. An SMS code goes to your phone number, which makes the number itself the target. In a SIM swap, someone impersonates you to the mobile carrier and moves your line to their SIM — and the codes then arrive on their handset. SMS two-factor is better than nothing, but there is no reason to choose it when something else is offered.
An authenticator app (TOTP) derives a six-digit code on your device every thirty seconds from a secret shared with the server. Nothing travels over the phone network, so a SIM swap is irrelevant. The QR code shown at setup is that secret, so do not leave a screenshot of it in your cloud photo roll. Write the backup codes down on paper against the day you change handsets.
The strongest option is a hardware security key (FIDO2/WebAuthn). On each login the browser proves which domain it is talking to, so a pixel-perfect fake site with a different domain simply cannot complete the handshake. Because there is no code to read out or type in, the usual phishing route disappears. Register two keys where you can, and keep the spare somewhere else.
Order of priority: your exchange account, your email account, then your password manager. Do not leave email for later — whoever holds your inbox can reset passwords everywhere else. One clarification: two-factor authentication protects accounts at services such as exchanges. It does not protect the keys in a self-custody wallet; that job belongs to offline storage of the seed phrase and to reading what you sign.
Watch out for
- · Do not leave screenshots of backup codes in cloud storage
- · Two-factor authentication cannot save a self-custody wallet whose seed phrase you have handed over
- · Calls and DMs posing as '2FA reset support' exist to extract your code — never read a code to anyone
Frequently asked questions
What happens if I lose the phone with my authenticator app?
The backup codes issued at setup will get you back in. Without them you are into the exchange's identity-verification process, which takes time. Write the codes on paper first, and where possible register a second device as well.