Card 07Turning on two-factor authentication (2FA)

2FA stands for two-factor authentication. The principle:

Something you know
        +
Something you have

password
    +
temporary code on your iPhone

If an attacker gets your password, they are still missing the second factor.

7.1 The different forms of 2FA

SMS - you receive a code by text message. Far better than no 2FA at all, but the method depends on your phone line.

Authenticator app - the app generates a code that changes regularly. Apple's Passwords app can itself store and generate these codes for compatible services.

Passkey or security key - mechanisms based on FIDO/passkeys or security keys are designed to resist phishing. NIST and CISA recommend phishing-resistant authentication methods for sensitive accounts wherever possible.

Practical recommendation

1. Passkey available?
2. yesUse the passkey
3. Otherwise an authenticator app?
4. yesUse the app
5. Otherwise
6. Turn on SMS 2FA at minimum

SMS 2FA is still better than no 2FA.

7.2 Careful: a 2FA code can be stolen too

A fake site can ask for your password and your verification code at the same time. You then hand over both. A 2FA code, received or generated, must stay secret.

"I work for Apple / Instagram / your bank. Give me the code you just received."