Backup codes first, before anything else
In the previous class we got everyone's password manager working. If you missed that class, complete it before this one, because two-factor and password managers are a package deal.
Today we're enabling two-factor login. And before I show you how to enable it anywhere, I'm going to show you how to save your backup codes. In that sequence. Not the reverse.
Let me explain why I'm rigid about the order.
The hour I locked myself out of my own email
Some time ago I set up two-factor on all my accounts on a Saturday, feeling rather pleased with myself. Then I got a new phone. My authenticator app did not transfer, because that isn't how it works, and I hadn't saved a single backup code. I sat there for an hour, locked out of my own email, on my own computer, in my own house — because I'd done the security part correctly and skipped the contingency part entirely.
That troubled me. So now backup codes come first in this class. Every time.
What two-factor actually is
Briefly: two-factor means logging in requires two elements instead of one — your password, plus a code that changes. The code typically arrives as a text message, or from an app on your phone, or from a short list of backup codes you saved in advance.
The principle is that if someone steals your password from some breached website, they still cannot get in, because they don't have your phone.
Backup codes, step by step
When you enable two-factor for any account, look for an option labeled something like "backup codes" or "recovery codes." Most services offer this. Do not skip past it to reach the part that feels more interesting.
- Find the two-factor or "2-step verification" setting. It's usually under Security in your account settings.
- Before you complete setup, locate "get backup codes" or "recovery codes." Select it.
- You'll receive a list, usually eight to ten codes. Each one works exactly once.
- Write them on paper. Actual paper. Or print the page.
- Store that paper somewhere you'll actually locate later. Not a sticky note on the monitor — a drawer, a folder, wherever you keep other important documents.
- Don't store them as a photo on your phone if that phone is the same device you might lose along with the account. Paper needs no charging and doesn't get left in an Uber.
That's the whole procedure. Now, if you ever lose your phone, break it, or upgrade it without planning ahead as I did, you have a route back in. That one hour of mine earned this class a rule.
Then enable two-factor itself
Once your backup codes are stored safely, go ahead and enable two-factor properly. Text-message codes are the simplest option, and I want to state plainly: text-message two-factor is fine. You'll hear security specialists online call text codes the weak option, and technically they're correct. But a text code you actually enable beats a more sophisticated method you never get around to setting up. Don't let anyone talk you out of enabling two-factor at all simply because it isn't the most advanced version.
We'll enable it together in class today, one row at a time, exactly as we did with the password manager. Email first, since that's usually the account through which everything else can be reset.
A word about Tiffany
When I first set Tiffany up with the password manager, she resisted it for a couple of weeks — something about not trusting one app to hold everything. Then she admitted she preferred not writing passwords on the back of the checkbook anymore. Two-factor drew the same reaction from her at first, and it settled the same way. It feels like additional steps until it simply becomes part of logging in, like fastening your seatbelt.
One caution
If a website asks you to text your two-factor code to someone, or to read it aloud to a caller claiming to be from your bank verifying your identity, hang up. That code is only ever meant to travel from the service to you. Nobody legitimate needs you to read it to them. It's the same trick as the fake bank calls we covered a couple of weeks ago, simply wearing a different hat.
Before next time
Save your backup codes on paper for at least your email account before the next class. That's the one piece I really don't want anyone skipping.
~kenneth