Skip to content
atlas

Two-factor authentication

Also known as: 2FA, two-step verification

The most common form of MFA, where logging in needs exactly two separate proofs, usually a password and a one-time code.

Draft - this entry has not been reviewed yet.

Formal

A form of multi-factor authentication limited to exactly two factors from different categories, most often a password combined with a code or approval from a device the user holds.

In plain English

Like a door with two different locks - one opened by what you remember, one by what is in your pocket.

In practice

An adviser at a pension fund working from home logs in to her work computer remotely with her password, then types the short code a code app on her phone shows before the session opens.

Why it matters

It is the step most services actually offer, so it is where most people first get protection beyond a password - but two proofs of the same kind, like two passwords, do not count.

How to put it into practice

The usual steps, in order. Adapt them to your organisation.

  1. List the accounts that matter most, starting with email because it can reset other passwords, then banking, accounting, cloud storage, social media and the company's domain and website hosting.
  2. Turn on 2FA, sometimes called two-step verification, in the security settings of each of these services.
  3. Pick the strongest second factor each service offers, a passkey or security key first, then an authenticator app, and SMS only when nothing else is available.
  4. Save the recovery codes when you enrol, keep them offline or in a password manager, and register a backup factor such as a spare key or a second device.
  5. Give each employee their own account instead of shared logins, and where a shared account cannot be avoided, keep its second factor in a company-controlled password manager or device, not on one person's phone.
  6. Use MitID Erhverv when employees act on behalf of the company in public self-service, and have the administrator remove their access when they leave.
  7. Teach everyone to reject login prompts they did not start and never to read out a code to a caller, and to change the password at once if an unexpected prompt appears.
  8. Check at least once a year and whenever someone leaves that 2FA is still on for every important account and that recovery phone numbers and addresses are current.

Common pitfalls

  • Losing access when a phone is replaced, because the recovery codes were never saved.
  • Leaving SMS or email recovery switched on as a fallback, which undoes a strong second factor.
  • Approving a prompt or reading out a code to someone who calls claiming to be from the bank or IT support.

Good guides

Technical deep dive

Two-factor authentication is MFA with exactly two factors, and in practice almost always a memorised secret plus a possession factor. The terms "2FA" and "two-step verification" (the name Google used when it opened the feature to all accounts in 2011) are often used interchangeably, but they are not strictly equivalent: two steps are not two factors if both are the same category, and a code sent to an email inbox reachable with the same password adds a step without adding an independent factor. Standards avoid the loose terms. NIST SP 800-63B speaks of multi-factor authentication at AAL2, and the PSD2 strong customer authentication rules require two independent elements from different categories.

The common second factors differ sharply in strength. SMS and voice codes depend on the phone network and are exposed to SIM-swap fraud, number porting and SS7 interception; NIST classes them as restricted. TOTP apps (RFC 6238) remove the network dependency but still produce a code a human can be tricked into typing on a phishing page. Push approvals are convenient but invite prompt bombing unless number matching is enforced. A FIDO U2F or FIDO2 security key used as the second factor after a password is phishing-resistant, because the signed response is bound to the site's origin. A passkey with user verification (a PIN or biometric on the device) is itself two factors in one step, which is why passkey-based login is often described as replacing, rather than adding to, the password-plus-code pattern.

The weakest link is usually not the primary second factor but the fallback. Services that offer SMS as a backup to a security key, account recovery by email, or a help-desk reset based on knowledge questions reduce the effective strength to that of the weakest enabled path; attackers target those paths precisely because the main factor is strong. Recovery codes - a short list of single-use secrets issued at enrolment - are a better fallback if stored offline.

2FA also does not protect what happens after login. Session cookies and refresh tokens captured by adversary-in-the-middle proxies, malware stealing browser cookies, and legacy protocols that accept only a password all sidestep the second factor. Organisations therefore enforce 2FA through central policy (conditional access in the identity provider) rather than per-application opt-in, disable legacy authentication, and monitor for new device registrations, which are a typical persistence step after an account takeover. In Denmark, MitID (for citizens) and MitID Erhverv (for organisations) provide the national multi-factor login, based on a user ID and an authenticator such as the MitID app, a code display, a code reader or a MitID chip.

What to learn first

Everything this builds on, foundations first.

  1. Digital identity
  2. →Password
  3. →Credential
  4. →Authentication
  5. →Authentication factor
  6. →Two-factor authentication

Relationships

Mitigates
Phishing

Sources & further reading

Standards & official texts

  • NIST SP 800-63B - Digital Identity Guidelines, Authentication · NIST

Course material

  • Cyber Security Fast Track - Ordliste

Where this data comes from

This entry was drafted by an AI from the sources above and has not yet been checked by a person. Treat it as a starting point, and check anything important against the sources.

See the review queueSuggest a correction on GitHubThis term as JSON

Check yourself

Loading…

Atlas is in beta.