What Is Two-Factor Authentication (2FA)? TOTP, SMS, and Security Keys
Two-Factor Authentication (2FA) is an essential security mechanism requiring users to provide two distinct authentication factors to verify their identity before granting account access.
💡 Plain-English Analogy
Think of 2FA like an ATM withdrawal: having only the ATM card is useless without knowing the 4-digit PIN, and knowing the PIN is useless without holding the physical card. You must have both factors to access your account.
⚙️ Architecture & Under the Hood
2FA enforces defense-in-depth across three canonical authentication categories: Something you know (password/PIN), Something you have (authenticator app with TOTP RFC 6238, FIDO2/WebAuthn hardware key), and Something you are (biometrics).
Comparing 2FA Verification Methods (Weakest to Strongest)
Not all 2FA methods provide the same degree of resistance to cyberattacks.
- SMS Text Messages: Convenient but vulnerable to SIM-swapping and cellular interception.
- TOTP Authenticator Apps (Google Authenticator, 1Password): Generates 6-digit codes every 30 seconds based on a shared secret key and current Unix time. Immune to SIM-swaps.
- Hardware Security Keys (FIDO2 / WebAuthn / YubiKey): Cryptographically bound to the browser domain, completely immune to phishing attacks.
Frequently Asked Questions
How do TOTP authenticator apps work without an internet connection?
TOTP (Time-based One-Time Password) uses a shared cryptographic secret key combined with the current timestamp (rounded to 30-second intervals). Both your phone app and the server perform the exact same math locally, generating matching 6-digit codes without needing to communicate over the internet.