How to choose and set up two-factor authentication (2FA), and what to do if you lose your device

Passwords are no longer enough. Credential stuffing, weak passwords, the same account and password being used to try elsewhere after a small website is dragged into the database - these things happen so frequently that "my password is quite complex" hardly constitutes a line of defense. Two-factor authentication (2FA) solves this problem: by adding another verification in addition to the password, the attacker cannot get in even if he only gets the password.

Reference: Binance Academy (https://academy.binance.com/en/articles/what-is-two-factor-authentication-2fa). The following is a reorganized version according to my own understanding, focusing on how to choose, how to set up, and what to do if something goes wrong.

What exactly is 2FA verifying?

Its logic is to require two types of credentials of different natures, rather than asking for the same thing twice. The three common categories are: something you know (password, PIN), something you have (mobile phone, hardware key, device that can receive or generate one-time verification code), and your own characteristics (fingerprint, face).

Most people actually use the combination of "password + one-time verification code". It is much more difficult for an attacker to get both your password and your second factor than to steal just one password.

There’s an easily overlooked distinction here: two-step verification and true 2FA are not exactly equivalent. The former might use two factors of the same type, such as a password plus a security question, both of which fall into the category of "something you know"; the actual 2FA requirement factors come from different categories. Of course, in actual products, the two terms are often used interchangeably. In most scenarios, the password is paired with a one-time verification code.

Six common forms, what are their respective weaknesses?

**SMS verification code. ** Best compatibility, no need to install app or buy hardware. But it is afraid of SIM card hijacking - the attacker tricks the operator into transferring your number to a card they control, and the verification code falls into the hands of others. 2FA is better than nothing, but it is one of the weaker options.

**Authenticator App. **Tools such as Google Authenticator and Authy generate time-based one-time passwords (TOTP), which are refreshed every 30 seconds. It can be used without being connected to the Internet and is not affected by SIM card hijacking. The price is that it is tied to the device on which it is installed. If the phone is lost and there is no backup, the account may not be accessible.

**Hardware token. ** Physical keys like YubiKey work offline, are immune to most remote attacks, and are first-tier in security. The disadvantage is that you have to spend money to buy it and carry it with you; if it is lost or broken, you need to replace it, and you need to have a backup recovery method.

**Biometrics. ** Fingerprint and face, fast, no need to enter code. What really matters is how to store and protect biometric data - if your fingerprint is leaked, you can't change it like a password. Most mobile phones now come with this capability.

**Email verification code. ** Familiar, no additional equipment required. The problem is that email becomes a single point of failure: whoever gets into your email can bypass your 2FA. Usually only used when there are no better options.

**Passkey and FIDO2. ** This is a newer standard. It does not rely on "password + verification code", but stores a pair of keys on the device. You use biometrics or PIN to unlock the device to complete authentication, and the server cannot get your private key. Because there are no passwords or verification codes to cheat, it is naturally immune to phishing websites. Google, Apple, Microsoft and other platforms will gradually support it from 2023.

By the way, Passkey is positioned to replace the old model of "password + verification code", rather than being used as a second factor, so it is not the same concept as 2FA.

Setup process and the most easily skipped step

Each interface is different, but the sequence is basically the same: first decide which method to use (for most people, the authenticator App is a balanced choice between security and convenience, and there is no need to buy additional hardware); then go into the security or account settings of the account, find the entrance to double verification/two-step verification and follow the prompts to open it; then complete the binding. The authenticator App usually scans the code, the SMS is to confirm the mobile phone number, and the hardware token is to register the device.

The last step is the easiest to skip: **Save the backup code. ** When turning on 2FA, the service provider will usually give you a set of recovery codes, which can be used to save you when the main verification method fails. Print it out and lock it in a drawer or put it in a password manager. Don’t just take a screenshot and keep it on the same phone. Without a backup code, account retrieval may take a long time.

Several things to observe after using it

The one-time verification code will not be given to anyone, even if the other party claims to be customer service or the official platform. The phishing page will trick you into entering the verification code in real time, so confirm the domain name first when you see the login page. Try not to perform verification operations on public Wi-Fi, as traffic may be intercepted. Open all accounts that support 2FA, not just the ones you use every day. If you change your phone or lose your device, immediately go to all associated accounts to update the settings. It is also a good habit to take a look at which devices and applications still have permissions every once in a while.

Exchange Account: What else to verify besides 2FA

Once a crypto asset account is stolen, the consequences are much more serious than a social account, so it’s worth spending a little more thought here. In terms of security, give priority to using authenticator apps or hardware tokens instead of text messages; switches such as the whitelist of currency withdrawal addresses and currency withdrawal confirmation emails are also checked.

As for costs, from the perspective of handling fees and rebates, there are a few points worth checking in your account instead of listening to others: what are the maker and taker rates for spot and contract respectively, what caliber is the VIP level divided by (such as trading volume or position), whether the BNB deduction is really effective in your level, how much is actually deducted after deduction, and if you use the rebate channel, what base and period are the rebates settled on? These numbers are different for each company, each category, and each activity, and will also be adjusted. I won’t give specific values ​​here—it’s what you see on the rate page and bill yourself that counts.

FAQ

**Is SMS 2FA Enough? ** Stronger than just using a password, but easiest to break in several ways. For accounts holding larger amounts, it is safer to switch to a validator app or hardware token.

**What should I do if the device is lost? ** Use the backup code saved when opening, or follow the service provider's account retrieval process. This is why backup codes should be saved on the day of setup.

**Can 2FA guarantee the absolute security of the account? ** cannot. It only raises the threshold for attacks, and paths such as phishing, social engineering, and the device itself being invaded still exist.

##Finally

2FA is a cost-effective step, but it’s not a talisman. Which method you choose depends on your usage habits and platform support. The key point is not to run naked - especially accounts related to money.

This article is only a compilation of general information and does not constitute investment advice, nor does it represent the official position of any platform.