EDITS Services Cyber Tips About Talk to us

Cyber Tips

Multi-factor authentication: the four kinds, ranked

Multi-factor authentication means needing a key and a lock combination to open your door. Even if somebody steals the password, they are still standing outside.

People talk about it as if it were one thing. It is four things, and they are not equally good. Any of them beats none of them — but one difference matters more than all the others, and almost nobody is told about it.

The difference that matters You type password + 6-digit code Fake login page looks identical keeps both The real site signs the attacker in within seconds step 1 step 2
A code you can read out can be handed to the wrong person. A hardware key or a passkey checks the website's real address before it will work at all — so on a fake page, it simply refuses. That is the whole difference.

Ranked, best first

  • 01 Hardware key or passkey A physical key, or one stored in your phone or password manager. Can't be phished
  • 02 Authenticator app Six digits that change every 30 seconds. Free, works with no signal. Phishable
  • 03 Push approval "Approve this sign-in?" Easy — and easy to tap yes by reflex. Phishable
  • 04 Text message Still stops the person who only bought your password. Phishable
MethodStops a stolen password Stops a fake login pageSurvives a lost phoneCost
Hardware keyYesYes Yes, if you own two$25–50 each
PasskeyYesYes If syncedFree
Authenticator appYesNo With backup codesFree
Push approvalYesNo NoUsually free
Text messageYesNo NoFree

If you only change one thing: move your email off text messages. Email is the master key — whoever controls it can reset every other account you own.

Do this today
  1. Turn on multi-factor for your email, your bank and your password manager. In that order — email first, because everything else resets through it.
  2. Use an authenticator app rather than text messages wherever the site offers one. It takes about two minutes per account.
  3. Save your backup codes somewhere that is not the phone — printed, or in your password manager. Losing a phone should be annoying, not catastrophic.
What good looks like

Your email, your bank and your password manager all require a second factor, and at least the first two use an app or a key rather than a text message.

You could lose your phone today and still get back into everything by tomorrow morning.

Want someone to just do this for you? Tell us what is going on — twenty minutes, free.