Turning on two-factor authentication (2FA)

2FA stands for two-factor authentication. The principle:

Something you know
        +
Something you have

password
    +
temporary code on your iPhone

If an attacker gets your password, they are still missing the second factor.

7.1 The different forms of 2FA

SMS — you receive a code by text message. Far better than no 2FA at all, but the method depends on your phone line.

Authenticator app — the app generates a code that changes regularly. Apple's Passwords app can itself store and generate these codes for compatible services.

Passkey or security key — mechanisms based on FIDO/passkeys or security keys are designed to resist phishing. NIST and CISA recommend phishing-resistant authentication methods for sensitive accounts wherever possible.

Practical recommendation

Passkey available?
        ↓ yes
Use the passkey

Otherwise an authenticator app?
        ↓ yes
Use the app

Otherwise
        ↓
Turn on SMS 2FA at minimum

SMS 2FA is still better than no 2FA.

7.2 Careful: a 2FA code can be stolen too

A fake site can ask for your password and your verification code at the same time. You then hand over both. A 2FA code, received or generated, must stay secret.

"I work for Apple / Instagram / your bank. Give me the code you just received."