You can make your online accounts more secure by following official guidance from the Electronic Frontier Foundation to enable two-factor authentication. This guide explains how to set up second factors like passkeys, security keys, authenticator apps, and SMS.
What it does
Two-factor authentication adds a requirement for additional proof alongside your password when you log in. According to the Electronic Frontier Foundation, this provides greater account security so that even if someone gets ahold of your password, they cannot access your account without the secondary means of authentication.
Before you start
The Electronic Frontier Foundation recommends setting up a password manager and using unique passwords for each site first. You should also poke around your account settings to find the option to enable 2FA.
Steps
Step 1: If you choose to use a passkey, the site will create and store a passkey on the device you make it on like your phone or laptop. You will need to have that specific device handy to log in with that passkey, though some password managers will sync the passkey across devices.
Step 2: If you opt for a security key, you need to insert the key, confirm that you want to create a credential typically by tapping or pushing a button on it, and then follow the directions to finish linking it to your account.
Step 3: If you use a mobile authenticator app, you need to scan a QR code on your computer screen with your phone. After that your phone will start generating rotating codes, and you will have to enter one of those codes to prove you completed this process successfully.
Step 4: If you turn on SMS, you will receive a code that you then need to type in to finish the process of enabling 2FA.
What the organization says
The Electronic Frontier Foundation advises that when you have the luxury of choice, you should think of each type of 2FA in order of passkeys, security keys, push notification-based authentication, authenticator app or TOTP authentication, and SMS. The organization also suggests starting your security setup with email accounts, then file backup services, followed by social networks and communication apps.
What to do
- Set up a password manager and use unique passwords for each site first.
- Opt to use an authenticator app, passkey, or a security key instead of SMS when possible.
- Print out and carry single-use backup or recovery codes if you are worried about losing access to your phone.
Key facts and where they come from
- Two-factor authentication adds a requirement for additional proof alongside your password during login.
adding a requirement for additional proof ("factors") alongside your password when you log in.
- Passkeys are a newer option that provide security and can functionally replace passwords and 2FA.
Passkeys are a newer option for logging in that provide all the security of 2FA, with a lot less hassle.
