Lesson 1
Understanding Authentication Strengths
Compare common 2FA methods to choose the safest option for your accounts.
Ranking your security options
Not all 2FA is equal. SMS-based codes are vulnerable to 'SIM swapping', where an attacker hijacks your phone number to receive your codes. This is better than nothing, but it is not optimal. Authenticator apps (like Authy, Microsoft Authenticator, or Google Authenticator) generate codes on your device using a time-based algorithm, making them immune to interception by mobile carriers. Hardware security keys (like YubiKey) are the gold standard; they require you to physically touch a device to log in, making it impossible for a remote attacker to gain access even if they have your password. Always prioritise authenticator apps or physical keys. Avoid SMS whenever an alternative is provided. By moving away from SMS, you remove the weakest link in your digital identity. Use this hierarchy to decide which accounts require the strongest protection, typically banking, email, and primary cloud storage first.