3.1: The 2FA Ladder
The 2FA Ladder
Two-factor authentication (2FA) means the door needs two different kinds of proof: something you know (the password) plus something you have (usually your phone). A stolen password alone stops working. That single idea defeats the entire Module 1 threat of leaked credentials replayed by machines, because the machine doesn’t have your phone.
But “turn on 2FA” hides a real spread of quality. The options form a ladder, and it matters which rung you’re standing on.
Rung 1: Text-message codes — better than nothing, and that’s all
The site texts a six-digit code to your number. This does stop bulk credential stuffing, and if it’s the only option a site offers, take it. Its weakness is one you met in Lesson 1.3: the code goes to your phone number, and your number can be stolen. In a SIM swap, an attacker convinces your carrier to move your number to their SIM, and every text meant for you arrives on their phone instead, reset codes and 2FA codes included. (If it ever happens to you, the Safety Center has a step-by-step response guide; Module 5 covers the carrier PIN that makes it much harder.)
The proof that phone numbers are the weak rung came from the very top. In the Twitter incident of 2020, attackers took over some of the most scrutinized accounts on the planet — Obama, Musk, Gates, Apple — not by cracking cryptography, but through phone-based social engineering of Twitter’s own staff and internal tools. If the highest-value accounts on earth can fall through phone channels, the lesson is worth taking seriously: anything that trusts a phone call or a text message inherits the security of a customer-service department.
Rung 2: Authenticator apps — codes without the phone number
An authenticator app (Google Authenticator, Microsoft Authenticator, or the one built into your password manager) generates the six-digit codes on the device itself, from a secret it received once when you scanned a setup QR code. No text message, no phone number, nothing for a SIM swap to intercept. This is the rung everyone should stand on as a baseline, and it costs nothing.
Rung 3: Push prompts — convenient, with one trap
Some services replace codes with a push prompt: a notification asking “Trying to sign in? Approve / Deny.” Great usability, one failure mode: approve-fatigue. Attackers who have your password trigger prompts over and over — 2 a.m., again, again — until a groggy thumb taps Approve. The rule that keeps push safe: a prompt you didn’t cause is an attack in progress. Deny it, then change that password.
Rung 4: Passkeys and hardware keys — the phishing-proof top
Every rung below this one shares a flaw: a code you can read is a code you can be tricked into typing into a fake page. The top rung, passkeys and hardware security keys, removes the human-readable secret entirely. There’s nothing to intercept and nothing to mistype into a lookalike site. Why that’s true is the next lesson.
Do this now, not after the course
Take the master key from your 1.4 list — your primary email — and turn on app-based 2FA for it right now: account security settings → two-step verification → authenticator app. Scan the QR code with your authenticator (your password manager probably offers to store it; let it), enter the confirmation code, and download the recovery codes it offers, straight into the manager’s notes for that account. Ten minutes, and your master key now requires something no leaked list contains.