Level 1 · 1A Passwords · Lesson 3 of 3
The second step: apps, keys and codes
Two-step verification asks for two proofs that it's you: something you know (your password) and something you have (your phone or a key) or something you are (your fingerprint). Even if someone steals your password, they're missing the second proof.
Three kinds of second step, from least to most secure
A code by text message is better than nothing, but an attacker can trick you into giving it to them, or get a copy of your SIM card (this is called a SIM swap). An authenticator app creates a six-digit code that changes every thirty seconds and doesn't depend on your phone line. A physical security key or a passkey is the strongest: it can't be handed over to a fake page.
Where to start
Start with your email, because it's used to recover all your other accounts. Then your bank, your payment apps and your social media. When you turn it on, keep the recovery codes somewhere safe: they're your lifeline if you lose your phone.
Going deeper
How the changing codes work
When you scan the QR code, the service and your app share a secret. Both calculate the six-digit code from that secret and the current time, which is why they match and why it works even when your phone has no internet. Passkeys use public-key cryptography: the private key never leaves your device and is tied to the real website, so it doesn't work on a fake copy.
Review questions
Which of these second steps is the strongest?
Answer: A security key or a passkey. A key or passkey can't be handed over to a fake page. The secret question is the weakest: the answer is often on your social media.
Someone who says they're from your bank asks you for the six-digit code you just received. What do you do?
Answer: Hang up: that code is never shared with anyone. That code is exactly the proof that it's you. Whoever asks for it is trying to get into your account.
Which account should you protect first with the second step?
Answer: Your email. Your email is used to reset the passwords of almost all your other accounts. It's the master key.