Password plus your phone
Day 144 of 149
👉 Full deep-dive with code examples
The Bank Vault Analogy
To access a bank vault, you need:
- A key (something you have)
- A PIN code (something you know)
Having just one isn't enough. Someone who steals your key can't get in without the PIN.
Two-Factor Authentication (2FA) works the same way!
You need two different types of proof to log in.
Why Passwords Aren't Enough
Passwords can be:
- Stolen → Attackers may get them from data breaches
- Guessed → People use weak passwords
- Phished → Fake websites trick you
With only a password, if someone gets it, they can often log in as you.
How 2FA Helps
Even if someone has your password, they still need the second factor:
Types of second factors:
- Something you have:
- Your phone (SMS code, authenticator app)
- A security key (like YubiKey)
- Something you are:
- Fingerprint
- Face recognition
Some systems also use extra signals (like location or device) to reduce risk, but the classic factor categories are: know / have / are.
How It Works
- Enter username and password (first factor)
- System asks for second factor
- You provide a code from your phone or scan fingerprint
- Both verified? You're in!
Password ✓ (something you know)
+
Phone code ✓ (something you have)
=
Access granted!
Why It's Important
- Attacker gets your password → They may still be blocked
- You lose your phone → They still need your password
- Harder for attackers to have BOTH factors
Note: some 2FA methods (like SMS or one-time codes) can still be phished in real time. Phishing-resistant options include hardware security keys and passkeys (WebAuthn).
In One Sentence
Two-Factor Authentication requires two different types of proof to verify your identity, making accounts harder to compromise than password-only login.
🔗 Enjoying these? Follow for daily ELI5 explanations!
Making complex tech concepts simple, one day at a time.
Top comments (0)