By the end of this lesson you will be able to
- Explain what multifactor authentication is and why it stops most account takeovers.
- Compare SMS codes, authenticator apps, security keys and passkeys.
- Store recovery codes safely and explain what they are for.
- Explain what a session is, and sign out of other devices.
- Use a public or shared computer without leaving your accounts open.
Even a strong password can be stolen by a fake website or leaked in a breach. A second lock means that a stolen password alone is not enough. This lesson explains that second lock, what to do so that you never lock yourself out, and what happens when you stay signed in on devices you do not control.
Three kinds of proof
To prove who you are, you can offer something you know, something you have or something you are. A password is something you know. A phone that receives a code, or a small security key, is something you have. A fingerprint or face scan is something you are. Multifactor authentication (MFA, also called two-factor or two-step verification) asks for two different kinds. A criminal who steals your password still does not have your phone.
- Password or passphrase
- PIN
Can be guessed or stolen.
- Phone with an authenticator app
- Security key
- Bank card and reader
Can be lost, but cannot be copied remotely.
- Fingerprint
- Face scan
Convenient; used mainly to unlock devices.
Read this figure as text
Three columns: something you know, something you have and something you are, with examples.
Something you know: a password, a passphrase, a PIN. Something you have: your phone with an authenticator app, a security key, a bank card with a reader. Something you are: a fingerprint, your face. MFA means using two different columns together, for example a password plus a code from your phone. Two passwords are not MFA because both are things you know.
Types of second factor
Not all second factors are equally strong. Think of them as a ladder, from acceptable to best.
| Method | How it works | Strengths | Weaknesses |
|---|---|---|---|
| SMS code | A text message with a short number | Easy; works on any phone | Can be intercepted through SIM swapping or a fake message; needs mobile signal |
| Authenticator app | An app on your phone shows a code that changes every 30 seconds | Works offline; not tied to your phone number | If the phone is lost, you need recovery codes |
| Security key | A small physical device you plug in or tap | Very hard to phish | Costs money; you must keep a spare |
| Passkey | A secret stored on your device and unlocked by your fingerprint, face or PIN, replacing the password | Cannot be typed into a fake site; nothing to remember | Support still growing; follow each service's setup |
A passkey is the newest option. Instead of typing a password, your device proves who you are to the real website, and only that website, so a fake site gets nothing. When a service offers passkeys, they are a good choice. Where they are not offered, an authenticator app is the best everyday second factor, and an SMS code is far better than no second factor at all.
Read this figure as text
A sequence diagram: Joseph types his password, the site asks for a code, his phone app shows it, he types it and the site lets him in.
Actors: Joseph, a website, his authenticator app. Step 1: Joseph gives the website his email and password. Step 2: the website says the password is right and asks for a six-digit code. Step 3: Joseph opens the authenticator app on his phone, which shows a code that changes every 30 seconds. Step 4: Joseph types the code into the website. Step 5: the website checks the code and lets him in. A thief who knew only the password would stop at step 2.
Turning it on, step by step
Each service words this slightly differently, so the exact menus vary. The pattern is the same. Turn it on first for your email, then your bank and phone account, then your other important accounts.
Turn on an authenticator app for an account
Step 1: Open the security settings
Sign in to the real service and look for Security, Sign-in or Two-step verification in its account settings.
You should see: You see an option to turn on two-step verification or two-factor authentication.
Step 2: Choose an authenticator app
Pick the option for an authenticator app. The service shows a QR code on screen, which is a way of giving the app the secret it needs.
You should see: A square QR code and, usually, a long text key appear.
Step 3: Scan it with the app on your phone
Install a well known authenticator app from your phone's official store, choose Add account and scan the QR code. The app starts showing a six-digit code that changes about every 30 seconds.
You should see: The app lists the account with a changing six-digit number.
Step 4: Type the current code
Type the code that the app shows into the service to prove it works.
You should see: The service says two-step verification is on and shows your recovery codes.
Step 5: Save the recovery codes
Store the recovery codes as the next section explains before leaving the page.
You should see: You have the codes somewhere safe, not only on the phone you just set up.
Recovery codes: your spare key
If you lose your phone, the second factor is lost too, so the service gives you a set of recovery codes: single-use codes that let you sign in once without the phone. Each can be used only once. Treat them like a spare house key. Print them or write them on paper and keep them with important papers, or store them in your password manager's secure notes. Do not keep them only in the phone that holds the authenticator, in an email, or in a photo in your gallery.
- Printed or on paper with important papers
- Secure notes in a password manager
- Not on the phone that holds the app
You can recover from a lost phone.
- Only on the same phone
- In your email inbox
- In a photo in your gallery
- In a message to yourself
A thief or a lost phone ends your access.
Read this figure as text
Two columns showing good and bad places to keep recovery codes.
Good places: printed or handwritten on paper kept with important documents at home; the secure notes of your password manager; a second trusted device that is not the phone with the authenticator. Bad places: only on the same phone as the authenticator app; in your email inbox; in a photo in your gallery; in a message to yourself. Check the codes still work occasionally and generate a new set if you use them up.
Account recovery is the process for getting back in when you have lost everything. It usually asks for a recovery email or phone number you set up in advance. Check these two details are current and that they are yours: attackers who take an account sometimes add their own recovery details. Keep your recovery email protected by MFA too.
Sessions: staying signed in
When you sign in, the site gives your browser a small token so that you do not need to type your password for every page. This stay-signed-in state is a session. It is convenient, but it also means that anyone who uses your browser or steals the token can act as you without a password.
Most services have a page called something like Devices, Where you are signed in or Sessions in their security settings. It lists devices and places currently signed in. Review it from time to time. If you see one you do not recognise, choose Sign out for it, or Sign out of all devices, and then change your password.
Device locks and public computers
A screen lock stops anyone who picks up your device from using your accounts. Lock your laptop whenever you step away: press Super and L on Ubuntu, or the Windows key and L on Windows. Set the device to lock itself after a short idle time. On Windows 11 look in Settings, Accounts, Sign-in options for the setting about when Windows asks you to sign in again. On Ubuntu look in Settings under Privacy & Security for the screen settings. Use a screen PIN or password of reasonable length on your phone, not 1234.
On a computer that is not yours, such as a library, cyber café or a friend's laptop, assume that it might be watched or leave your login behind. Where possible use your own phone. If you must use the computer: open a private browsing window, sign in, do only what you must, then sign out of the site (closing the window is not enough), close all private windows and never let the browser save the password. Avoid banking on shared machines. Afterwards, change the passwords if you typed them on a machine you do not trust.
- Step 1: Private windowOpens with no saved history
- Step 2: Sign in only if neededDecline save password and stay signed in
- Step 3: Do the taskAvoid banking if you can
- Step 4: Sign out, closeUse Sign out, then close the window
- Step 5: Change later if unsureFrom your own device
Read this figure as text
A flow of five steps for using a public computer safely.
Step 1: open a private browsing window. Step 2: sign in only to what you must, and decline any offer to save the password or keep you signed in. Step 3: do your task. Step 4: sign out of every site, using the Sign out button, then close the private window. Step 5: if the machine seemed untrustworthy, change the password later from your own device.
Signs that an account is compromised
Watch for: a code or reset email you did not request, a sign-in alert from an unknown device, friends reporting odd messages, changed recovery details, settings you did not change or purchases you did not make. Act at once by following the steps in the lesson on what to do when something goes wrong: use a clean device, change the password, review sessions and recovery details and turn on MFA.
Common mistakes
✖ Instead of: Setting up an authenticator app and never saving recovery codes.
✔ Do this: A lost or broken phone then locks you out. Save the codes on paper before you finish.
✖ Instead of: Giving a code to someone who rang and sounded official.
✔ Do this: Codes are for you alone. Hang up and ring the number on your card or on the official site.
✖ Instead of: Using “Remember me” on a shared computer.
✔ Do this: Decline it. Use a private window and sign out.
✖ Instead of: Thinking MFA makes passwords unimportant.
✔ Do this: MFA is a second lock, not a replacement. Keep passwords long and unique too.
If something goes wrong
- My authenticator codes are rejected.
- Check your phone's clock is set to automatic time, because the codes depend on the time. Make sure you are using the code for the right account and that you type it before it changes.
- I lost my phone and cannot get codes.
- Use a recovery code to sign in, then set up the authenticator on your new phone and create a new set of codes. If you have no codes, use the service's official recovery page.
- I did not get an SMS code.
- Check you have signal and the number on the account is correct. Wait a minute before asking again, and consider switching to an authenticator app.
Key terms
- Multifactor authentication (MFA)
- Signing in with your password plus a second proof, such as a code from your phone.
- Recovery code
- A one-time code, saved safely, that lets you get back into an account if you lose your phone or second step.
- Authenticator app
- An app on your phone that creates short-lived codes for signing in.
- Passkey
- A sign-in method that replaces the password with a key held on your device and unlocked by your fingerprint, face or screen lock.
- Session
- The period during which a site remembers that you have signed in.
- Screen lock
- A password, PIN or fingerprint needed to use a device after it sleeps or is switched on.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Turn on a second factor for your email
On your own laptop and phone, sign in to your email account on the real website and open its security settings. Find the two-step verification option and set it up with an authenticator app if available, otherwise with a code by text message. Save the recovery codes on paper. Do not write any password down, and stop if you feel unsure at any step.
Challenge: audit where you are signed in
Find the page in your email or social media account that lists devices or sessions where you are signed in. Without asking for help, identify every entry, sign out of any you do not recognise or no longer use, and set your laptop to lock after a short time. Note one change you made.
Knowledge check
7 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- MFA combines two different kinds of proof, so a stolen password alone is not enough.
- Passkeys and security keys are strongest, authenticator apps are a good everyday choice, and SMS is better than nothing.
- Keep recovery codes on paper or in your manager, separate from your phone.
- Sessions keep you signed in; review them and sign out of devices you do not know.
- Lock your screen, and on public computers use a private window and always sign out.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- Turn on 2-Step Verification (Google Account Help)
- Passkeys: signing in without a password (FIDO Alliance)
- Turn on 2-step verification (2SV) (National Cyber Security Centre (UK))