Two-Factor Authentication Setup

Authentication factors are usually grouped as something you know (password, PIN), something you have (phone, hardware key, TOTP seed), and something you are (biometric). 2FA means two different groups, not two passwords. A second "know" (a security question from lesson 3) is a weak extra secret, not a second factor. After credential stuffing, the attacker has the know. They still need the have. That is why email and the password manager deserve 2FA first: they are the reset and vault hubs from the last lesson.

SMS codes are "have" in a loose sense: possession of the number. The number is an account at a carrier, not a key in your pocket. SIM-swap and number-port abuse are risks — attackers socially engineer or coerce a carrier into pointing your number at a SIM they control, then receive the texts. This course does not teach how to do that. It teaches why SMS is the weakest common 2FA: the factor is the phone number, and numbers can be moved without your handset. Use SMS only when the site offers nothing stronger, and lock the carrier account with a PIN if your operator provides one. Do not disable 2FA just because SMS is imperfect — weaker 2FA still beats password-only for most stuffing.

TOTP (time-based one-time passwords) stores a shared secret in an authenticator app. Every 30 seconds the app and the server compute the same short code from that secret plus the current time. The code is useless after it expires and useless on a phishing site unless you type it there while the attacker relays a live login — still better than SMS, not as origin-bound as a hardware key. Scan the QR on a device you own; do not screenshot TOTP QR codes into cloud albums. Hardware keys (FIDO2/WebAuthn) prove possession to the real domain: a lookalike site cannot complete the ceremony. Prefer key or TOTP over SMS when the account offers it. Push prompts are convenient; "approve" fatigue is a real failure mode — only approve logins you started.

When you turn on 2FA, most services print one-time backup codes. They are the have you store offline so a dead phone is not a lockout. They are also a stealable second factor if they live in the same inbox the account protects. Save them in the password manager vault or print them — the next lesson goes deeper on recovery. For this lesson, the practical bar is: enable TOTP on one account you own, save the backup codes immediately, and complete one successful login with the app before you close the setup screen. Email or the manager vault is the highest-value target. Do not enroll 2FA on a friend's account "for practice."

Priority order for your own life: (1) mailbox that resets other sites, (2) password manager, (3) banking and cloud, (4) everything else that offers TOTP. Work/school SSO may mandate a specific app — follow that policy; do not bypass it with SMS "because it is easier." If a site only offers SMS, turn it on anyway, then add TOTP later if they ship it. Removing 2FA because setup felt fiddly returns you to stuffing-only defense.

Use email or your password manager if it supports TOTP. Paths are usually Settings → Security → Two-step / 2FA. Install an authenticator you choose from an official store. Do not send codes to classmates. Do not enroll a device you do not control.

You now treat 2FA as know + have: SMS as the weakest have (number-port risk, not a how-to), TOTP as a device-held secret, hardware keys as origin-bound, and backup codes as part of enrollment. Next — Account Recovery — you set recovery email, phone, and offline codes so you can get back in without handing attackers a second door.