Two-Factor Authentication: Which Second Factor Is Actually Best

Two-factor authentication prevents the vast majority of automated account compromise attacks. Microsoft research suggests 2FA blocks over 99 percent of such attacks. But not all 2FA methods are equally secure — the specific second factor matters substantially.

The 2FA Hierarchy

From weakest to strongest:

**SMS codes.** Easy to set up, widely supported. Vulnerable to SIM swapping where attackers transfer your phone number to their device. Use SMS only when nothing better is available.

**Email codes.** Depends entirely on your email security. If email is compromised, every account using email 2FA is compromised. Chain-of-trust problem.

**TOTP apps** (Google Authenticator, Authy, 1Password built-in). Codes generated on your phone, no internet required. Not vulnerable to SIM swapping. The practical minimum for serious 2FA.

**Push notifications** (Google prompts, Microsoft Authenticator). Approve or deny from your trusted phone. Convenient but vulnerable to "notification fatigue" attacks where attackers spam prompts hoping for accidental approval.

**Hardware security keys** (YubiKey, Google Titan). Physical device required. Resistant to phishing because the key verifies the actual domain. Resistant to remote attacks. Gold standard for consumer 2FA.

**Passkeys.** Device-based cryptographic credentials replacing passwords entirely. Uses biometrics. Phishing-resistant. Growing adoption across major services.

The SIM Swapping Problem

SIM swapping has become widespread for high-value targets. Attackers gather personal information from data breaches, call your mobile carrier impersonating you, and request SIM transfer. If successful, your phone number goes to their device and SMS codes arrive there.

Mobile carrier security varies. Even major carriers have had numerous SIM swapping incidents. The practical implication: SMS 2FA is better than no 2FA but should not be used for high-value accounts.

Which 2FA for Which Accounts

**Critical accounts** (banking, email, cryptocurrency, work with sensitive data): hardware security key or passkey.

**Important accounts** (social media with payment info, cloud storage): TOTP app minimum, hardware key preferred.

**Routine accounts** (streaming, forums, utilities): TOTP app. SMS acceptable if TOTP not offered.

**Low-value accounts**: any 2FA offered is better than none.

The Hardware Key Reality

Hardware security keys are the most secure consumer 2FA method but have adoption barriers:

**Cost.** $25-70 each; typically want two (primary and backup).

**Compatibility.** Major services support them. Many smaller services do not.

**Setup complexity.** More steps than SMS enrollment.

**Loss risk.** Without backup, loss can lock you out of accounts.

For users willing to invest: buy two YubiKey 5 Series devices. Register both to all critical accounts. Keep one on your keychain, store the other in a safe. Maximum security with reasonable practical setup.

Passkeys: The Emerging Standard

Passkeys represent next-generation authentication. Cryptographic credentials on your trusted device, unlocked by biometrics. No password to steal or phish.

Current adoption: Google, Apple, Microsoft, Amazon, PayPal, and many others support passkeys. The transition from passwords is in progress and accelerating.

For users ready: enable on supporting services, keep passwords as fallback until comfortable, understand backup and recovery options.

The Backup Code Reality

Every 2FA system provides backup codes — one-time codes for when primary 2FA is unavailable. Critical for account recovery.

Research-supported practices: store backup codes in password manager plus printed copy in physically secure location. Never email or text them to yourself. Treat as high-value secrets.

Common failure: setting up 2FA, not saving backup codes, losing access to primary 2FA, getting locked out for weeks.

The Practical Adoption Framework

**Week 1:** TOTP 2FA on email (most important account because it's used for recovery of other accounts).

**Week 2:** TOTP 2FA on password manager, banking, primary social media.

**Weeks 3-4:** 2FA on all other services supporting it.

**Month 2:** Upgrade critical accounts to hardware keys or passkeys where supported.

**Ongoing:** 2FA at signup for new accounts, not planned for later.

The research is clear: 2FA on critical accounts dramatically reduces compromise risk. The specific method matters, but any 2FA is substantially better than password-only. The ideal is hardware keys for critical accounts, TOTP for important accounts, SMS only as last resort.