Two-Factor Methods, Ranked

Every service now offers a second factor and most offer several. They are presented as equivalent security improvements. They are not, and the differences matter against specific, common attacks.

What a second factor is for

Passwords fail in three ways: they are reused and exposed in a breach elsewhere, they are guessed, or they are phished.

A second factor means a stolen password alone is insufficient. How much protection it adds depends entirely on whether the second factor can also be stolen the same way.

The methods, weakest to strongest

SMS codes. A code sent to your phone number.

Protects against: password reuse, breached password lists, guessing. This is genuinely valuable and covers the most common attack.

Does not protect against: phishing, since you will type the code into a convincing fake site as readily as your password. Also vulnerable to SIM swapping, where an attacker persuades your carrier to move your number to their device — a documented and not-rare attack against people with valuable accounts.

Verdict: far better than nothing. Use it where nothing better is offered. Do not use it for your email or financial accounts if an alternative exists.

Email codes. A code to your email address.

Protects against the same things as SMS, and inherits the security of your email account. If email is compromised, this factor is worthless. Never use email as the second factor for the email account itself, which some services still permit.

Authenticator apps. A code generated on your device from a shared secret, rotating every thirty seconds.

Protects against: everything SMS does, plus SIM swapping, plus interception. No network involvement.

Does not protect against: phishing. The code goes into the fake site just as readily.

Verdict: a clear improvement over SMS, widely supported, and the sensible default for most accounts.

Push approval. A prompt on your phone asking you to approve a sign-in.

Protects against: the same set, with better usability.

Does not protect against: fatigue attacks, where an attacker with your password triggers prompts repeatedly until you approve one to stop the noise. This has been used successfully against large organisations.

Verdict: good, provided it shows context — location, device, and a number you must match. Number matching largely closes the fatigue attack.

Hardware security keys and passkeys. A cryptographic key held in a device or secure enclave, which signs a challenge bound to the specific site.

Protects against: everything above, including phishing. This is the decisive difference. The key checks the domain. On a fake site, it simply does not produce a valid response, and the user cannot be talked into overriding it.

Does not protect against: someone with physical possession of the key and your device unlocked.

Verdict: the only method that stops phishing. Use it for your email and financial accounts if supported.

Why phishing resistance is the dividing line

Almost every method above stops a stolen password. Only the last one stops a convincing fake login page.

Phishing is the dominant attack against individuals. The message looks legitimate, the site looks correct, the user enters password and code, and the attacker uses both within seconds. Every code-based method fails here by design, because the code is just another thing to type.

If you protect one account with a passkey or hardware key, make it your primary email. Everything else can be reset through it, which makes it the account that matters most.

Recovery is the part everyone skips

The most common way people lose accounts is not attack. It is losing the second factor.

Save recovery codes when the service offers them, and store them somewhere that is not the phone. Printed and filed is fine. A password manager is fine if the manager is not protected by the factor you just lost.

Register more than one factor. Two keys, or an authenticator plus a key, so losing one is inconvenient rather than terminal.

Check whether your authenticator syncs. Some do, some deliberately do not. If yours does not, a lost phone means every code is gone.

Set up account recovery contacts where the platform supports them.

Practical arrangement

Email account: passkey or hardware key, with recovery codes stored offline. This is the keystone.

Financial accounts: the strongest method offered, usually an authenticator app.

Everything else: authenticator app, or SMS where that is all there is.

Never: SMS as the only factor on an email account, or email codes for the email account.

Registering a second factor on twenty accounts is an afternoon. Losing the email account is a much longer afternoon.