Two-Factor Authentication (2FA)
Two-Factor Authentication
What is two-factor authentication (2FA)?
- A password plus a second check
- Text code, app, fingerprint, and more
- Protects you even if breached
Turning on 2FA doesn’t change how users log in so much as it changes the attacker’s cost-benefit calculation. Attacks that automatically replay leaked username and password lists can try thousands of logins per second, yet every one of them stops at the second factor. To get into a single account, the attacker would have to separately obtain the victim’s phone or authentication app. Rather than make that effort, they move on to a company that has 2FA turned off. Defenders gain time to treat a password leak as an 'alert' rather than an 'incident'.
The second factor varies in strength. SMS codes are vulnerable to SIM swapping, where an attacker hijacks the carrier line, and to message-forwarding apps. The 6-digit authenticator-app code that refreshes every 30 seconds (TOTP) stops brute-force attacks, but real-time phishing, which tricks users into typing the code into a fake login page, gets past it. FIDO2 security keys and passkeys refuse to sign when the domain doesn’t match, so they are structurally resistant to phishing. With three or more factors it is called MFA, and SSO, which opens multiple services with a single login, is just a convenience that reduces how often users authenticate, not a substitute for 2FA.
Look at the scope of coverage too. If you protect only human logins and leave API tokens, service accounts, and email-sending accounts untouched, the back door stays open. These accounts can’t use 2FA, so you compensate by limiting token lifetime to 90 days and restricting access to an IP allowlist. Sessions work the same way: if the cookie issued after a 2FA login is stolen, the system won’t ask for the second factor again. That is why sensitive actions such as payment approvals or permission changes should require re-authentication.
In practice, lockouts cause more real incidents than hacks do. An employee who changed phones without moving their authenticator app and has no backup codes can’t get into their account. The moment an admin disables 2FA in a hurry, that account becomes a permanent exception. Building the recovery process first is half of a successful rollout. Push approvals have a weakness too: if twenty notifications arrive in the middle of the night, someone will eventually tap one, so push without number matching becomes a channel for fatigue attacks. “We told everyone to turn it on” and “2FA is on for every account” are very different statements, so each quarter, pull the list of accounts without it and check.
Seolyeong ParkGenerative AI and AX training expert with 17 years of hands-on experience and 200+ sessions, making AI usable right away even for non-specialists
Seungtae ParkPractical AX instructor who teaches by building AI business development and marketing automation hands-onMulti-factor authentication, long used in finance and enterprise security, went mainstream with the spread of smartphones and became the standard safeguard against account takeover.
Consider a hypothetical case: Company A, an e-commerce business with 180 employees and annual revenue of around KRW 120 billion (≈ US$89,780,000). Over six weeks, about 40 login attempts from unknown sources hit the GitHub organization account used by its 24 developers, and one of them succeeded using a former employee’s account. A payment integration key was still stored in a repository, so the CTO ordered 2FA for the entire company.
- When Kim, the security manager, pulled the account list, only 7 of the 24 developers had 2FA turned on. The rest had put it off, saying receiving codes was a hassle.
- The CTO set authenticator apps as the standard instead of SMS, and issued two security keys to each of the 5 people with repository admin rights: one for the desk, one for the wallet.
- In the first week of rollout, an intern who had swapped phones was locked out and lost half a day. Kim, the security manager, added a step to the manual: print 10 backup codes and keep them sealed in an envelope in the safe.
- A month later, one developer reported getting eight approval notifications at 2 a.m. The team switched push approvals to number matching that same afternoon.
- After 6 weeks, 2FA coverage across company accounts rose from 29% to 100%. Successful external login attempts fell from 3 per quarter to 0, and account lockout requests dropped from 11 in the first month to 1 the next.