Two-step sign-in

A six-digit code has exactly 1,000,000 possible values, so a thief with your password who gets five guesses has a 1 in 200,000 chance.

A thief has your password. What are the odds of the code?

Start with a puzzle. Someone has stolen your password, but the site also asks for a six-digit code, and the thief gets five tries. How likely is a lucky guess? Work it out in the exercise below before reading on.

Six digits run from 000000 to 999999, which is 10⁶ = 1,000,000 codes. Five guesses give a chance of 5 in 1,000,000, or 1 in 200,000. With the password alone the thief was already in. With the code, almost never. That gap is what multi-factor authentication buys you.

Three kinds of proof, and why two passwords are still one

Multi-factor authentication, often called two-factor or two-step sign-in, asks for proof from more than one kind of factor. CISA sorts the kinds into something you know (a password or PIN), something you have (a phone or a security key) and something you are (a fingerprint or face). Two passwords are still one kind. CISA's advice for everyone is to turn MFA on for every account that offers it, starting with email, social media and financial accounts. Email comes first because password reset links are sent there. Whoever controls your inbox can reset almost everything else.

Codes that can be relayed, and keys that cannot

The common options differ in how well they hold up. A code sent by text message or voice call travels over the phone network. NIST classes this as a restricted authenticator. It is still allowed, but services must offer an alternative and warn users of the risks, and should watch for signs such as a recent SIM change or number transfer, because criminals can talk a phone company into moving your number to their SIM. A code from an authenticator app is generated on your phone and never crosses the network. Push notifications ask you to tap Approve. Criminals sometimes send dozens of prompts, hoping you tap one to make them stop, so CISA recommends number matching, where you type a number shown on the login screen.

All of these can still be phished. A fake login page asks for your code, you type it in, and the criminal passes it to the real site within seconds. NIST says plainly that methods involving manual entry of a code are not phishing-resistant, because nothing ties the code to the real site. CISA calls phishing-resistant MFA the gold standard and says the only widely available kind is FIDO/WebAuthn: security keys and passkeys, which, as the previous unit showed, only answer to the site they were made for. Any MFA is still much better than none.

Before the phone goes missing

When you turn on two-step sign-in, most services show a list of one-time recovery codes. NIST calls these look-up secrets. They are your way back in if you lose your phone, so keep them somewhere safe and separate from the phone: printed and stored at home, or in a password manager. Never paste them into an email to yourself, and never read one out to someone who calls you. No genuine support team needs it.

Plan for a lost or replaced phone before it happens. Most services let you register more than one second factor, for example an authenticator app and a security key, or a passkey on two devices. When you change phones, move your authenticator app or passkeys to the new phone before you wipe the old one. If a phone is lost, sign in with a recovery code or another factor and remove the lost device from each account.