Two-Factor Authentication (2FA)

Overview

What it means

Two-factor authentication requires two independent categories of proof before granting access, such as a password and a security key. It reduces the usefulness of a stolen password but does not by itself authorize safe transactions.

How it works

Services can use authenticator apps, hardware security keys, passkeys under an appropriate multi-factor model, or other second factors. Strong phishing-resistant methods bind authentication to the legitimate website or cryptographic challenge. For high-risk crypto actions, add transaction-specific review and approval.

Understanding the technical details

Authentication strength depends on factor independence and resistance to real-time phishing. Hardware security keys and origin-bound authentication can stop attacks that easily bypass SMS or ordinary one-time passwords. Enforce stronger checks for administrator login, changing payout destinations and creating high-privilege API credentials. Backup codes are effectively alternative credentials and need protected storage. Audit account recovery, because an attacker may target the weaker recovery process instead of the primary login.

Additional protocol context

Strength varies significantly. SMS codes, push approvals, one-time passwords, passkeys, and hardware security keys resist different threats. Real-time phishing, SIM swapping, malware, notification fatigue, recovery abuse, and session theft can bypass otherwise valid second-factor checks.

Systems should prefer phishing-resistant methods for sensitive access, bind authentication to the legitimate service, limit attempts, secure enrollment, and protect recovery. Administrative changes, new-device registration, treasury actions, and disabled-factor requests require strong verification and auditable notification.

Common failures and limitations

SMS codes are vulnerable to SIM-swap and interception attacks; ordinary one-time codes can be phished in real time. Losing recovery methods can lock out legitimate users, so backup and account-recovery processes must be designed carefully.

Related concepts

Private Key, Webhook Signature, Crypto Payment Fraud.

Further reading

NIST — Digital Identity Guidelines.