You Need a 2FA Authenticator. RIGHT NOW!

Your password isn’t enough anymore. And if you think it is, we need to talk.

I want you to think about something for a minute. How many online accounts do you have? Email? Facebook? Amazon? Banking? Cloud storage? Maybe a few shopping sites you haven’t visited in years? Now let me ask you another question. How many of those accounts are protected by nothing more than a password?

If the answer is most of them, we need to have a conversation.

And I’m not talking about next week. I’m not talking about when you have a little extra time. I’m talking about RIGHT NOW.

Because here’s something I wish more people understood. Your password is no longer enough.

Now, before Steve starts explaining how he uses a sixteen-character password with uppercase letters, lowercase letters, numbers, special characters, and the name of his childhood goldfish, let me explain something. Even a really good password can be stolen.

It can be exposed in a data breach. It can be captured by a fake website. It can be stolen by malicious software. And if you’re using that same password on multiple websites, one compromised account can put several others at risk.

That’s where two-factor authentication comes in.

Two-factor authentication, or 2FA, is actually a pretty simple idea. Instead of proving who you are with just a password, you provide a second form of verification. Usually, that means something you know, like your password, combined with something you have, like your phone or a security key.

Think of it this way. Your password is the key to your front door. Two-factor authentication is another lock that requires something different to open it. Somebody might steal your key, but that doesn’t automatically mean they can get inside.

And before somebody asks, yes, a determined criminal can sometimes get around two-factor authentication. Nothing is absolutely foolproof. But adding that second layer can make stealing your account considerably more difficult.

So how does this work?

Let’s say you’re signing into your email. You enter your username and password just like you’ve always done. But instead of immediately opening your inbox, the website asks for a six-digit code. You open an authenticator application on your phone, find the code for that account, enter it, and you’re in.

Those codes generally change every thirty seconds. They’re generated using a secret shared between your authenticator and the website when you first set it up. Most authenticator apps can generate these codes without cellular service or even an internet connection.

And here’s the beautiful part. You don’t have to be a computer expert to use one.

There are several good authenticator applications available. Google Authenticator and Microsoft Authenticator are popular choices. If you prefer an open-source option, take a look at Aegis Authenticator for Android or 2FAS, which supports Android and iPhone.

Personally, I like seeing people explore open-source alternatives. But this isn’t one of those situations where I’m going to insist that everybody use my favorite application. The important thing is choosing a reputable authenticator, understanding how its backup or recovery process works, and actually using it.

Now, I know what you’re thinking. “Okay, Outlaw, you’ve convinced me. But WHICH authenticator should I use?”

Well, that’s a great question, and the good news is you’ve got choices!

Microsoft Authenticator is a popular option, especially for people who use Microsoft 365. It supports standard verification codes and Microsoft’s own sign-in approval methods. Google Authenticator is a straightforward choice for people who simply want an application that generates verification codes without a lot of extra features.

Then there’s Duo Mobile, which you may already be familiar with if you work for a business, university, or other organization that uses Duo Security. Duo is especially common in environments where an organization wants to protect employee or student accounts. It supports standard verification codes as well as Duo’s own push-based authentication system.

If you’re interested in open-source alternatives, 2FAS is worth a look. It’s available for Android and iPhone and focuses on providing a straightforward, privacy-conscious authenticator. Android users might also consider Aegis, which offers encrypted backups and plenty of control over how authentication codes are stored. Ente Auth is another interesting open-source option, particularly for people who want encrypted synchronization between devices.

And here’s something important. You don’t necessarily need a different authenticator for every account. Many websites use the same standard for those familiar six-digit codes, which means you can often manage multiple accounts from one application. However, certain sign-in methods, including some Microsoft and Duo push notifications, require their respective applications.

So before you just download the first authenticator you see, check out our Hints & Tips section for our guide, “Which Authenticator Is Right for You?” We’ll walk through the popular choices, explain the advantages and disadvantages, and help you find the right authenticator for your needs. Whether you’re protecting your personal email, managing work accounts, or looking for an open-source alternative, we’ll help you get started.

No technical degree required. And I promise we won’t make you read a million-word EULA just to understand the options!

Now, you might be thinking, “But I already get a text message when I sign in. Isn’t that the same thing?”

Not exactly.

Text-message verification is better than having no second factor at all, but SMS has weaknesses. Criminals can sometimes hijack telephone numbers through SIM-swapping attacks, and text messages depend on the security of the cellular network and your phone account.

An authenticator application that generates codes locally doesn’t depend on your telephone number in the same way.

And there’s an even stronger option worth knowing about. Passkeys and hardware security keys can provide protection against many phishing attacks that can fool people using ordinary six-digit codes. If a service supports passkeys, they’re well worth considering. But don’t let the search for the perfect solution keep you from enabling the protection available to you today.

Now let’s talk about something that really concerns me. Your email account.

If you do nothing else after reading this article, protect your primary email account.

Why?

Because think about what happens when you forget a password. What does almost every website tell you to do?

“Click here and we’ll send you a password reset link.”

And where does that link go?

YOUR EMAIL!

Your email account is often the master key to your entire digital life. If somebody gets into it, they may be able to reset passwords, intercept account notifications, and work their way into other services you use.

That’s why I tell people to start with email. Then move to banking, financial accounts, social media, cloud storage, shopping accounts, and anything else containing personal information or payment details.

And while we’re talking about security, let me give you another piece of advice. SAVE YOUR RECOVERY CODES!

When you enable two-factor authentication, many websites provide backup or recovery codes. Those codes can help you regain access if you lose your phone or your authenticator stops working.

Don’t ignore them. Don’t assume you’ll never need them. Store them somewhere secure and separate from the device you’re protecting. A reputable password manager or a securely stored offline copy can be a good option.

Because the only thing worse than somebody else being locked out of your account is YOU being locked out of your account.

And Steve, before you ask, NO, a sticky note on the bottom of your keyboard is not my first choice.

Now, here’s another thing you need to understand. Just because you have an authenticator doesn’t mean you can stop paying attention.

Criminals have become pretty clever. Some phishing websites ask for your password AND your authentication code, then immediately use both to sign into the real website. Others bombard people with authentication approval requests, hoping they’ll eventually press Approve just to make the notifications stop.

So if your phone suddenly asks you to approve a sign-in you didn’t initiate, DON’T APPROVE IT.

If somebody calls claiming to be from your bank, Microsoft, Google, or your company’s IT department and asks you to read them your authentication code, DON’T DO IT.

A legitimate support representative should not need you to hand over a one-time sign-in code.

And if you receive an unexpected authentication request, take it seriously. Somebody may already know your password. Check the account through its official website or application and change your password if you suspect it’s compromised.

Now, I can already hear somebody saying, “This sounds like a lot of trouble.”

Really?

Let me ask you something.

How much trouble would it be to lose access to your email account? How much trouble would it be if somebody took over your Facebook account and started messaging your friends asking for money? How much trouble would it be to discover that somebody had accessed your cloud storage or financial information?

Suddenly, opening an app and entering six numbers doesn’t sound so inconvenient, does it?

And here’s the thing. Most services allow you to remember trusted devices, so you may not have to enter a code every single time you sign in. The exact behavior depends on the service and its security settings.

You might spend a few extra minutes setting everything up today, but those few minutes could save you hours, days, or even weeks of frustration later.

So here’s what I want you to do.

Before you finish your next cup of coffee, open your phone’s app store and find a reputable authenticator application. Install it. Then go to your primary email account, open its security settings, and enable two-factor authentication. Follow the instructions, scan the setup QR code if prompted, and securely save any recovery codes you’re given.

And if you’re still not sure which application to install, that’s exactly why we’re putting together the Hints & Tips guide. You don’t have to figure all this out by yourself.

Once you’ve protected your email, start working through your other important accounts.

You don’t have to do everything in one sitting. But you do need to start.

And if a service offers a passkey or security key option, take a few minutes to learn about it. The technology keeps improving, and protecting your digital life is worth a little effort.

Look, I love technology. I love finding new ways to use old hardware, exploring Linux, and discovering open-source alternatives to expensive software. But none of that matters much if somebody else can walk right into your accounts because you never bothered to lock the door.

The internet isn’t the same place it was twenty years ago. Passwords get stolen. Databases get breached. Scammers get smarter. And ordinary people get caught in the middle.

You don’t have to be paranoid. You don’t have to become a cybersecurity expert. You just have to take a few sensible precautions.

Your password is the first lock on the door. Two-factor authentication is the second. And if somebody is trying to get inside, you’ll be glad you installed it.

So please, don’t put this one off.

Get an authenticator. Protect your email. Secure your important accounts. Save your recovery codes.

And the next time Steve tells you his password is so complicated that nobody could ever guess it, remind him that criminals don’t always have to guess.

Sometimes they just steal it.

Until next time, don’t be a Steve.

The Open Source Outlaw