Module 2 · 2.3

English

Nederlands English Deutsch Français

Two-factor authentication: codes, apps and SMS

Module 2: Passwords and logging in · Reading time: 11 minutes

Learning objective: After this lesson you can compare the forms of two-factor authentication (SMS, email, TOTP, push), recognise the attacks on them, and arrange recovery for when your phone is lost.

Key concepts: 2FA/MFA, factor (knowledge, possession, inherence), TOTP, shared secret, push notification, MFA fatigue, SIM-swap, recovery codes

Two different kinds of proof

A password is something you know. If it leaks, anyone who knows it can log in. Two-factor authentication (2FA) therefore asks for a second piece of proof of a different kind. With more than two, you speak of multi-factor authentication (MFA); in practice the terms are used interchangeably.

There are three kinds of factors:

Knowledge: a password or PIN code.
Possession: your phone with an app, a security key, a card.
Inherence: your fingerprint or face.

Two of the same kind don't count: a password plus a security question are two things you know. The NCSC strongly advises using MFA on every system and account that supports it, and certainly on accounts reachable via the internet and accounts with admin rights. For a small business, that includes at least: email, hosting and domain registration, bank, bookkeeping, web shop, the password manager and the business's social media.

The forms side by side

Form	How it works	Weak spot	Phishing-resistant?
Code by SMS	The service sends a code to your phone number	SIM-swap, interception, your number isn't your device	No
Code by email	The service sends a code to your mailbox	As strong as your mailbox; if that's taken over, this isn't a second lock	No
Authenticator app (TOTP)	An app generates a new code every 30 seconds	The secret can leak during setup or in a poor backup; you type the code across	No
Push notification	Your phone asks "Is this you?" and you tap Approve	MFA fatigue	No, number matching is better
Passkey or security key	Your device cryptographically proves who you are, only for the real domain	Recovery if you've lost everything	Yes (lesson 2.4)

Every form is far better than no second step. But the table also shows: anything where you type over a code or approve a notification can be triggered by a scammer on their fake site. NIST puts it plainly in SP 800-63B-4: methods where you enter the result by hand are not phishing-resistant.

How an authenticator app works

An authenticator app uses TOTP: Time-based One-Time Password, described in RFC 6238. It works like this:

When setting up, the service creates a random shared secret, for example 32 characters like JBSWY3DPEHPK3PXP.... That secret is contained in the QR code you scan, or you type it over as a "manual key".
Your app and the service now both have the same secret. After that, no further contact between the two is needed.
Every 30 seconds, both calculate the secret plus the current time into a 6-digit code. Because they have the same secret and the same clock, the same code comes out.
When logging in, the service compares your code with its own result, usually with a margin of one time step before or after for a clock that's slightly off.

Two consequences:

The secret is the actual lock. Whoever sees the QR code or the manual key can forever generate the same codes as your phone. So don't screenshot it, don't share it with anyone, and don't send it to a colleague.
The code also works without internet and doesn't arrive via the phone network. That's why TOTP is stronger than SMS.

Authenticator apps come in various forms: standalone on your phone, built into a password manager, open source or from a large tech company, with or without an encrypted backup in the cloud. Examples are Aegis, Google Authenticator and Microsoft Authenticator, alongside the feature in managers like Bitwarden or 1Password. A backup is handy when you get a new phone, but the NCSC warns: a poorly encrypted backup also gives an attacker access.

SIM-swap: why SMS is the weakest form

With a SIM-swap, a scammer takes over your phone number. They have your number transferred to a SIM card or eSIM that they control. This can succeed, for example, by impersonating you to your provider, or by getting you to cooperate yourself: the Fraud Helpdesk warns about text messages and calls "on behalf of your provider" saying your SIM card needs to be validated or urgently converted to an eSIM.

Once it succeeds:

your phone suddenly has no signal and you can't call or text yourself;
the scammer receives all SMS codes, including the "forgotten password" codes from services that use your number as a recovery method;
they can sometimes take over accounts with just your number.

The tricky part: you only notice once your phone stops working, often in the evening or at the weekend. NIST therefore calls SMS a restricted method, and says services should watch for signals such as a new SIM card or a number that's been transferred. The NCSC advises avoiding SMS where possible, because messages aren't encrypted and can be intercepted.

What do you do?

Choose an app or passkey over SMS wherever possible.
Remove your phone number as a recovery method where that's a weak spot, or protect it extra.
Ask your provider whether you can set an extra PIN or check for transferring your number.
Does your signal suddenly drop for no reason? Call your provider from another device. Don't wait.

SMS remains better than nothing. If a service only offers SMS, turn it on anyway.

MFA fatigue: the notification you tap away

With a push notification, you don't need to type anything over: your phone asks "Trying to log in?" and you tap Approve. Easy, and exactly for that reason, abused.

With MFA fatigue (also called push bombing), an attacker already has your password. They keep logging in repeatedly, so your phone receives one notification after another, sometimes in the middle of the night. The American CISA describes how people then tap Approve out of annoyance or by accident, or think that one of the notifications must be genuine. Sometimes the attacker also calls, posing as "the helpdesk", asking you to just approve it.

A real-world case described by the NCSC: attackers used MFA fatigue to get into the mail accounts of a software company and then used them for invoice fraud.

The rules:

Never approve a notification you didn't trigger yourself. Not even the twentieth one.
An unexpected notification means someone has your password. Change it immediately and report it.
Choose number matching where possible: the login screen shows a number that you type into the app. Anyone not sitting in front of the login screen then can't approve it. CISA calls this a good intermediate step, but weaker than phishing-resistant MFA.

Recovery: arrange it before your phone is lost

Your phone falls into water, gets stolen or breaks. Without preparation, you're locked out of your own accounts. That's why recovery codes (also called backup codes) exist: a row of spare codes you get when setting up, each of which works once.

Don't store them on the same phone as your authenticator app. Print them and keep them with your important papers, or store them in your password manager under the right item.
Used a recovery code? Cross it out. If you run out, generate new ones.
Make sure you have at least two ways to get in: for example, the app plus recovery codes, or two security keys.
With a new phone, transfer your accounts first and only wipe the old one afterwards.
Know how the recovery procedure for your most important services works. A good service doesn't simply reset your second step based on an email or phone call, but first verifies that it's really you.

In practice: what it looks like

In the WebOké environment, My WebOké always asks for a second step after your password: by default a code by email, and you can switch to an authenticator app. In DirectAdmin it's called Two-Step Authentication, with recovery codes. In Nextcloud you enable TOTP and generate ten backup codes. With other providers it works similarly: look in your profile or security settings for "two-factor authentication", "2FA", "authenticator" or "two-step".

The steps are almost always the same: scan a QR code, enter one code to confirm, save the recovery codes.

Summary

2FA combines two kinds of factors: knowledge, possession, inherence.
TOTP works with a shared secret and the clock. The secret (QR code) is the actual lock: never share it.
SMS is the weakest form due to SIM-swap and interception, but better than nothing.
MFA fatigue: never approve a notification you didn't trigger yourself, and then change your password.
Codes and notifications aren't phishing-resistant; passkeys and security keys are (lesson 2.4).
Arrange recovery codes and a second method before your phone is lost.

Quiz

Exercise

Exercise A2.3: Linking an authenticator app. You'll receive a QR code for a practice account "WebOké oefening". Scan it with an authenticator app of your choice and enter two codes that appear one after the other. The program checks whether your app is calculating correctly. The practice secret has no value and is deleted after 24 hours; remove the practice account from your app afterwards.

Exercise D2.3: Turning on two-factor authentication for your most important accounts. Turn on two-factor authentication on your email, hosting or domain registration, bank, bookkeeping and password manager. Store the recovery codes in a second location and answer the question of what you'll do if your phone is lost tomorrow.

Exercise D2.3: Turning on two-factor authentication for your most important accounts

Here's how to go about it: (1) Make a list of your most important accounts: mailbox, hosting and domain registration, bank, bookkeeping, webshop, password manager, business social media. (2) Turn on two-factor authentication for each one. Choose in this order, depending on what the service offers: passkey or security key, authenticator app, push notification with number matching, code by email, text message. (3) For each one, keep the recovery codes in a second place (printed or in your password manager), not on the same phone as your authenticator app. (4) Make sure you have at least two ways to log in for each important account. (5) Ask your provider whether you can set up an extra check or PIN for transferring your number. (6) Agree with your team: never approve a login prompt you didn't trigger yourself; report it straight away.

Mailbox has two-factor authentication
Hosting and domain registration have two-factor authentication
Bank and bookkeeping have two-factor authentication
Password manager has two-factor authentication
An app or passkey instead of text message wherever possible
Recovery codes for each account are kept in a second place
At least two ways to log in for each important account
Team agreement about unexpected login prompts

Your phone is gone tomorrow. Write down in three steps how you get back into your mailbox.

For which account could you only choose text message, and what do you do to reduce that risk?

Who on your team knows what MFA fatigue is? How do you explain it to the others?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing