{"id":2026100857,"date":"2017-02-21T00:00:00","date_gmt":"2017-02-20T17:00:00","guid":{"rendered":"https:\/\/danieel.id\/?p=2026100857"},"modified":"2026-10-12T14:04:31","modified_gmt":"2026-10-12T07:04:31","slug":"two-step-verification","status":"publish","type":"post","link":"https:\/\/danieel.id\/en\/two-step-verification\/","title":{"rendered":"Two-Step Verification: Why a Password Alone Is No Longer Enough"},"content":{"rendered":"
\n

Ever received a WhatsApp message from an old friend suddenly asking to borrow money, even though the way they wrote didn’t sound like them at all? Or heard about a relative whose social media account was taken over and then used to scam everyone on their contact list? Stories like these are no longer rare. What we seldom realize is that many of them could have been prevented with a single setting that takes only five minutes.<\/p>\n

This is where two-step verification comes in. With this feature, a password alone isn’t enough to get into an account; anyone trying to log in also has to pass a second step, such as a code from an app, a confirmation on your phone, or your fingerprint. How effective is it? Research by Google with New York University and UC San Diego<\/a> found that an SMS code alone blocked 100% of automated bot attacks and 96% of bulk phishing attacks, while an on-device prompt blocked 99% of bulk phishing. In other words, out of 100 account takeover attempts through bulk phishing, only about one to four get through.<\/p>\n

Well, two-step verification is a lot like withdrawing cash from an ATM. The card alone isn’t enough; without the PIN, the machine won’t give you a single cent. Your password is the card, and the second step is the PIN.<\/p>\n

A quick honest note: menu names and the location of settings in apps change fairly often, sometimes within just a few months. So the steps below are best read as directions, not a rigid sequence of clicks. If what you see on your phone looks different, just type “security”, “two-step verification”, “two-factor authentication”, or “passkey” into the settings search bar, or open the official help page linked in each section.<\/p>\n

Below, I’ve summarized how to turn it on for six services we use every day. But before that, let’s get to know the options for that “second key”. Let’s go through them one by one:<\/p>\n

Getting to Know Your Second Key Options: From SMS to Passkeys<\/strong><\/p>\n

\"Four<\/figure>\n

Not every second step is equally strong. From the simplest to the toughest, the order looks roughly like this:<\/p>\n