What is two-factor authentication, and should your app have it?

Two-factor authentication (2FA) asks for something besides a password, such as a code from an app, so a stolen password alone is not enough. Offer it for any account that holds value, and require it for administrators.

By Nazar Kashuba · Reviewed

Passwords are reused, guessed and stolen. A second factor means an attacker needs more than the password.

Common methods

  • Authenticator app codes. Time-based codes generated on the user’s phone. A good balance of security and convenience.
  • Hardware security keys and passkeys. Strongest against phishing, and increasingly supported.
  • Codes sent by SMS or email. Better than nothing, but weaker, as messages can be intercepted or accounts taken over.

Should your app have it?

  • Admin and staff accounts: require it.
  • Customer accounts holding money, personal data or sensitive records: offer it, and consider requiring it.
  • Low-value accounts: optional; do not add friction without need.

Design points

  1. Provide recovery codes, and a safe, deliberate way to recover if a device is lost, since that is a favourite route for attackers.
  2. Rate-limit code attempts.
  3. Do not rely on the same channel for both factors.
  4. Explain it plainly to users.

For your own accounts, such as hosting, domain, email and payment providers, turn it on today; it is one of the cheapest security measures there is.

Sources

All questions