MEPX
Chapter 4 of 10All chapters
  1. 1What makes a password strong
  2. 2The reuse problem
  3. 3Password managers
  4. 4Two factor authentication
  5. 5Passkeys
  6. 6Recovery and backup access
  7. 7Breaches
  8. 8Phishing your credentials
  9. 9Where secrets live
  10. 10A realistic plan

Chapter 4 of 10

Two factor authentication

Something you have.

The ladder

Weakest to strongest: security questions, email codes, SMS codes, authenticator apps, push approval, hardware keys. Anything above a password alone is a large improvement.

  • Enable it on email, banking and anything holding card details first.
  • Save recovery codes offline when you set it up.

Push fatigue

Attackers spam approval prompts until someone taps accept. Number matching, where you type a code shown on screen, exists to stop this. Never approve a prompt you did not trigger.