A password is something you know. The second factor is something you hold: a phone, an app, a physical key. The point is that a stolen password is no longer enough — the attacker knows the secret but is not holding your device.
It is the only measure that still works after a password has leaked, which is why it deserves to be switched on before you start changing passwords.
Tres métodos y sus diferencias
SMS: mejor que nada
A code arrives by message. Available everywhere and needs no setup, but it has a weak point: the number can be taken over. The scheme is called SIM swapping — an attacker restores a “lost” card using documents or a shop employee, and the codes start arriving to them.
A separate problem is roaming and poor coverage: the code fails to arrive exactly when you need it most.
Aplicación de autenticación: la opción sensata
The app shows a six-digit code every thirty seconds. It is computed from a shared secret and the current time, so no internet is needed at all — it works on a plane and without a SIM card.
The code can only be stolen along with the phone, or through a fake site where you type it in yourself. Against SIM swapping the method is immune.
One detail during setup: save the secret key or the QR code shown when you connect it. With it you restore access on a new phone without contacting support.
Llave física: el máximo
A physical device you plug in or tap against the phone. It verifies the site address cryptographically, so a fake page cannot work in principle: the key simply does not answer a domain it was not registered for.
It is the only method resistant to phishing. Downsides: cost, carrying it around, and the need for a second key in case the first is lost.
Cómo sabe el código la aplicación sin conexión
Al activarlo, el servicio muestra un código QR que contiene un secreto compartido: una cadena aleatoria. La aplicación lo guarda, el servicio también, y a partir de ahí no intercambian nada.
Desde entonces ambas partes toman la hora actual, la redondean a pasos de treinta segundos y calculan HMAC-SHA1 de ese número con el secreto compartido. Del resultado se extraen seis dígitos. Como la hora es la misma y el secreto es común, los códigos coinciden sin ninguna petición de red.
Dos consecuencias prácticas: la aplicación funciona en un avión y sin SIM; y si el reloj del móvil se desajusta mucho, los códigos dejan de valer.
Códigos de recuperación: hazlo ya
When you enable a second factor the service issues a list of one-time codes. They are shown once, and they are the only way in when the phone is lost, broken or wiped.
The typical mistake is saving them as a screenshot in the gallery of that same phone. When the phone goes, the codes go with it.
Keep them in a password manager, which syncs between devices, or print them and file them with your documents. Verify they are really saved before you need them.
Dónde es obligatorio
Email. Everything else is recovered through it, which makes it the first item rather than the last.
Banking and government services. Often required already, but check that it is not SMS.
The password manager. A vault holding every password is an obvious target.
Work systems and social media. A stolen work account hurts more than you, and a stolen social account is used for fraud in your name.
Qué no protege el segundo factor
It is useless against fake sites if you type the code into the attacker’s page yourself — they relay it to the real service in real time. Only a hardware key, or the habit of checking the address bar, helps there.
It also does not replace a strong password: it is a second line, not a substitute for the first.