Glossary

Two-Factor Authentication (2FA)

Two-factor authentication (2FA/MFA) protects an account with two independent proofs of identity. Even if a password is compromised, an attacker cannot log in without the second factor.

Three factor types

Something you know — password, PIN
Something you have — SMS code, TOTP app (Google Authenticator, Authy), hardware key (YubiKey)
Something you are — fingerprint, Face ID

TOTP

Time-based One-Time Password — the most common method. The app and server share a secret and the current time. Every 30 seconds both generate the same 6-digit number using HMAC-SHA1.

SMS 2FA

Most convenient but least secure: vulnerable to SIM-swapping and SS7 attacks. For critical systems, TOTP or hardware keys are preferred.