Last month, when a friend’s email account was compromised after a simple phishing attack, I once again saw how critical two-factor authentication (2FA) is. Even though the password was strong, the credentials stolen through the phishing attack opened the account wide, and my friend experienced a serious data breach. This incident painfully demonstrated how risky it is to rely solely on a password in the digital world and why we need to use 2FA.
Two-factor authentication simply means providing two different types of information to prove your identity when accessing an account. This is usually a combination of something you know (a password) and something you have (a phone, a hardware key). However, there are many 2FA methods on the market: SMS, mobile apps, and hardware keys. So, which one should you choose for your security needs, and what are the advantages and disadvantages of each? This post explains the points I consider when making this choice and my personal preferences.
Why Is Two-Factor Authentication (2FA) So Important?
Accounts protected by a single password are quite vulnerable to today’s cyber threats. Phishing attacks, credential stuffing (trial and error with stolen password lists), and brute-force attacks are common methods malicious actors use to gain access to your accounts. Once one of your accounts is compromised, this can have a domino effect on your other accounts, as most of us tend to use the same or similar passwords across different services.
2FA eliminates this single password weakness by adding a second layer of verification. Even if an attacker obtains your password, they cannot access your account unless they also possess the second factor (like your phone or hardware key). This additional security layer is vital, especially for critical accounts like email, banking apps, cloud storage, and social media. In my own systems, I enforce 2FA usage everywhere, from accessing the backends of my own side projects to critical management panels of client projects. The weakest link in the security chain is often human, and 2FA significantly strengthens this link.
SMS-Based 2FA: Convenience or Security Vulnerability?
SMS-based 2FA is one of the most common and easiest methods for users to set up. When you try to log into a system, a one-time code is sent to your registered mobile phone, and you verify your identity by entering this code. This method is preferred by many because it doesn’t require downloading an additional app or purchasing hardware.
However, SMS-based 2FA has significant security weaknesses. The most well-known is SIM swap attacks; in these attacks, malicious actors trick your mobile operator through social engineering or internal network access to gain control of your SIM card. Thus, the 2FA codes meant for you reach the attacker’s phone. Furthermore, it’s possible to intercept SMS messages through more complex methods like SS7 vulnerabilities. In my own experiences, I’ve seen that SMS carries serious risks due to these weaknesses, especially on critical financial platforms. For this reason, I never use SMS as my primary 2FA method for my critical accounts; however, I might use it as a backup option or for very low-risk services.
Mobile App-Based 2FA (TOTP): The Golden Ratio?
Mobile app-based 2FA typically works through applications that use the Time-based One-Time Password (TOTP) protocol. Apps like Google Authenticator, Authy, or Microsoft Authenticator generate a new code every 30 or 60 seconds using a specific algorithm and a secret key (seed). These codes are generated on your device even without an internet connection and are used when logging in.
This method offers significant security advantages over SMS-based 2FA. Since codes are not sent via SMS, they are not affected by SIM swap or SS7 attacks. Because the app runs within your device, an attacker would need to compromise both your password and your physical device. Personally, I use TOTP apps for many of my critical accounts, from my banking apps to most of my cloud services. I find the balance between the security it provides and its ease of use to be very successful. However, having backup codes or securely backing up TOTP seeds is critical if you lose or have your phone stolen. By storing these seeds in a secure password manager, you can achieve a degree of device independence.
Hardware Keys (FIDO U2F/WebAuthn): The Highest Level of Security?
Hardware keys are physical devices that typically plug into a USB port or work via NFC/Bluetooth. They use the FIDO (Fast IDentity Online) standard, specifically U2F (Universal 2nd Factor) or the newer WebAuthn protocol. These keys are highly resistant to phishing because they check not only the password but also the URL of the website you are connecting to during authentication. This means that even if you enter your password on a fake site, your hardware key will refuse to authenticate to the real site.
Hardware keys are indispensable for my most critical accounts, such as my main email account, root user access to my primary cloud provider, or the management interfaces of my own financial side product. Devices like YubiKey allow me to work with peace of mind. Hardware keys theoretically offer the most secure 2FA method, but they also have some disadvantages. Being tied to a physical device can create a serious problem if you lose your key; therefore, it’s essential to always have at least one backup key. Also, not all services currently offer FIDO U2F or WebAuthn support, which can limit their use. However, for services that do support it, using this method will significantly increase your security level.
When to Use Which Method: My Approach
When choosing between 2FA methods, it’s necessary to consider the risk profile and ease of use of each. I have a hierarchy that I apply to my personal and professional accounts. This hierarchy focuses on balancing my security needs with practical usability.
First, I prefer hardware keys for my most critical accounts. This includes my main email provider, my banking platforms, and the email account I use as a recovery email for all other services. Since compromising these accounts would jeopardize my entire digital identity, applying the highest level of security is mandatory. I always carry my primary key with me, and I keep a backup key in a secure safe.
Second, for accounts that don’t support hardware keys or that I consider less critical, I use mobile app-based TOTP. This category includes social media accounts, e-commerce sites, other SaaS platforms, and some less critical management panels of my own side products. TOTP apps offer a much more secure option than SMS, while also being quite practical for daily use. I back up the seed values of these applications in an encrypted password manager to increase my chances of recovery even if my phone is lost.
Finally, I use SMS-based 2FA only as an alternative method or in situations where the security risk is very low. For example, when signing up for an application for the first time or as a backup recovery method if other options are not available. However, always keeping in mind the vulnerability of SMS to SIM swap and other attacks, I make sure not to store very sensitive information in such accounts.
The table below summarizes these approaches:
| Method | Advantages | Disadvantages | When to Use |
|---|---|---|---|
| SMS | Easy setup, widespread access | SIM swap, SS7 attacks, phone loss risk | Low-risk services, as a backup verification method |
| TOTP App | Works offline, resistant to SIM swap | Device dependency, requires backup | Most critical accounts (email, social media, e-commerce), if no hardware key |
| Hardware Key | Phishing-resistant, highest security | Cost, physical device dependency, limited support | Most critical accounts (bank, root access, main email) |
Common Mistakes and Situations to Avoid
Using 2FA alone is not enough; using it correctly is also important. There are some common mistakes I’ve seen in my experience and around me that can seriously undermine the security provided by 2FA.
First, ignoring backup codes or backup hardware keys. If you lose your phone or your hardware key malfunctions, if you don’t have backups, your account access can be completely locked. This is one of the worst-case scenarios, especially when managing a critical workflow in a production ERP or deploying my own side product. Storing backup codes in print or in a secure password manager minimizes this risk.
Second, using the same 2FA method for all accounts. If you use SMS 2FA everywhere and experience a SIM swap attack, all your accounts are at risk. Using different methods for accounts with different risk levels diversifies your security layers and prevents the entire system from collapsing due to a single weak point.
Third, sharing 2FA codes or entering them on phishing sites. 2FA codes should never be shared with others. Also, if you land on a phishing site and it asks for a 2FA code, you should not enter it. Hardware keys, in particular, automatically prevent such phishing attempts because they do not authenticate to the wrong URL. However, if you are using SMS or TOTP, you must always carefully check whether the site is legitimate. When I forgot to enable 2FA for accessing a critical service on my own VPS, I saw how quickly brute-force attacks began. Although fail2ban kicked in immediately, I can’t forget the panic I felt at that moment and understood once again how critical 2FA is.
Conclusion
In the digital world, account security is no longer just about a strong password. Two-factor authentication (2FA) is one of the strongest defense mechanisms against cyberattacks and a feature every user should actively employ. When choosing between SMS, mobile app (TOTP), and hardware keys (FIDO U2F/WebAuthn), you should consider the security level, ease of use, and your risk tolerance for each method.
My personal approach is to prefer hardware keys for the most critical accounts, TOTP apps for other important accounts, and SMS for the lowest-risk scenarios or for backup. The important thing is never to rely on a single layer of security and to take proactive steps to protect yourself against evolving cyber threats. Today, if you haven’t already, enable 2FA on all your critical accounts to elevate your digital security to the next level. Remember, the best security measure is the one you implement.