Passwords alone are no longer sufficient to protect your online accounts. Data breaches expose billions of credentials every year, and many people reuse passwords across multiple services. Two-factor authentication (2FA), also called multi-factor authentication (MFA), adds a second layer of verification that makes it far harder for attackers to gain access even if they know your password. This article explains what 2FA is, how it works, the different methods available, and how you can set it up on your most important accounts and devices.

What Is Two-Factor Authentication?

Two-factor authentication is a security process that requires two distinct forms of identification before granting access to an account or system. These factors fall into three categories:

  • Something you know, a password, PIN, or security question answer.
  • Something you have, a physical device such as a smartphone, hardware token, or security key.
  • Something you are, a biometric trait like a fingerprint, face scan, or iris pattern.

2FA uses exactly two of these factors. For example, logging into your email with a password (something you know) and then entering a code sent to your phone (something you have). This combination dramatically reduces the risk of account takeover because an attacker would need both your password and physical possession of your second-factor device.

Why 2FA Matters Now

According to the 2023 Verizon Data Breach Investigations Report, 74% of all breaches involved the human element, including stolen credentials and social engineering. In Taiwan, the number of reported phishing attacks increased by 37% in 2022 compared to the previous year, according to the Taiwan Computer Emergency Response Team (TWCERT). Password reuse is a major factor: a 2022 survey by the Taiwanese nonprofit iThome found that 68% of respondents used the same password across at least three different online services.

Without 2FA, a single compromised password from a breached website can give attackers access to your email, social media, bank accounts, and even your PC build purchase history or online retailer accounts. With 2FA enabled, the attacker is stopped at the second step.

Types of Two-Factor Authentication

Not all 2FA methods offer the same level of security or convenience. Here are the most common types, ranked from least to most secure.

SMS-Based 2FA (Text Message Codes)

The most widely used method. After entering your password, the service sends a 6-digit code via SMS to your registered phone number. You enter that code to complete login.

  • Pros: Easy to set up, works on any phone, no app required.
  • Cons: Vulnerable to SIM-swapping attacks where a hacker convinces your mobile carrier to transfer your number to their SIM card. The US National Institute of Standards and Technology (NIST) has deprecated SMS-based 2FA as not sufficiently secure for sensitive accounts.

Authenticator App (TOTP)

Time-based One-Time Password (TOTP) apps generate 6-digit codes that refresh every 30 seconds. Popular apps include Google Authenticator, Microsoft Authenticator, Authy, and Duo Mobile. You scan a QR code during setup to link the app to your account.

  • Pros: Codes work offline, no SIM vulnerability, more secure than SMS.
  • Cons: If you lose your phone without backup codes, you can be locked out. Some apps (like Google Authenticator) do not sync across devices unless you manually transfer.

Push Notification

Instead of typing a code, you receive a push notification on your smartphone asking you to approve or deny a login attempt. Microsoft Authenticator and Google Prompt use this method.

  • Pros: Very convenient, one tap to approve.
  • Cons: Can lead to “MFA fatigue” if attackers repeatedly send push requests hoping you accidentally approve. Still more secure than SMS.

Hardware Security Keys (FIDO2/WebAuthn)

These are physical USB, NFC, or Bluetooth devices, such as YubiKey, Google Titan, or Thetis (a Taiwan-based brand). You plug the key into your computer or tap it on your phone to authenticate. Many services now support FIDO2/WebAuthn, including Google, Microsoft, GitHub, and Dropbox.

  • Pros: Highest security, resistant to phishing and man-in-the-middle attacks. No codes to steal.
  • Cons: Costs money (NT$1,000-2,500 per key). If you lose the key and have no backup, you may lose access.

Biometric 2FA

Uses your fingerprint, face, or iris. Often combined with a hardware key (e.g., a YubiKey Bio) or built into your smartphone (Face ID, Touch ID).

  • Pros: Fast and convenient.
  • Cons: Biometric data cannot be changed if compromised. Less common as a standalone second factor for online accounts.

How to Set Up 2FA on Your Accounts

Setting up 2FA usually takes less than five minutes per account. Below are step-by-step instructions for the most common services used in Taiwan and worldwide. Before starting, ensure you have a smartphone with an authenticator app installed, or a hardware security key ready.

Google (Gmail, Google Drive, YouTube)

  1. Go to myaccount.google.com and sign in.
  2. Click Security in the left sidebar.
  3. Under “How you sign in to Google,” click 2-Step Verification.
  4. Click Get started and enter your password again.
  5. Choose your method: Google Prompt (recommended), Authenticator app, or Security key.
  6. Follow the on-screen instructions. If using an authenticator app, scan the QR code with your app.
  7. Google will show you backup codes, save them in a secure place (e.g., a password manager or printed and stored in a safe).

Google’s Advanced Protection Program requires two hardware security keys and is recommended for journalists, activists, and anyone at high risk of targeted attacks.

Microsoft (Outlook, OneDrive, Windows Login)

  1. Go to account.microsoft.com and sign in.
  2. Click Security at the top, then Advanced security options.
  3. Under “Additional security,” click Add a new way to sign in or verify.
  4. Choose from Microsoft Authenticator app, Phone number (SMS), or Security key.
  5. Follow the prompts. The Microsoft Authenticator app supports push notifications and TOTP codes.

Windows 10 and 11 also support Windows Hello, which uses biometrics (fingerprint or face) or a PIN as a second factor when logging into your PC, useful if you share your computer or work remotely.

Facebook

  1. Click your profile picture in the top right, then Settings & Privacy > Settings.
  2. Click Security and login in the left column.
  3. Under “Two-factor authentication,” click Edit next to “Use two-factor authentication.”
  4. Select your method: Authentication app, SMS, or Security key.
  5. Follow the on-screen instructions. Facebook also offers “code generator” built into its mobile app.

Apple ID (iCloud, App Store, Mac Login)

  1. On your iPhone, go to Settings > [your name] > Password & Security.
  2. Tap Turn On Two-Factor Authentication.
  3. Verify your trusted phone number. Apple will send a verification code via SMS.
  4. Once enabled, you will receive push notifications on your trusted devices when signing in from a new device.

Apple’s 2FA is built into iCloud and macOS. There is no option to use a third-party authenticator app, Apple uses its own push-based system.

Local Taiwan Services (e.g., Chunghwa Telecom, E.Sun Bank, PChome)

Many Taiwanese banks and telecom providers offer 2FA via SMS or their own mobile apps. For example:

  • E.Sun Bank, uses a one-time password (OTP) sent via SMS for online banking transactions. They also offer a “Mobile Key” inside their app that generates a dynamic code.
  • Chunghwa Telecom, when logging into your account online, they send a 6-digit SMS code to your registered mobile number.
  • PChome 24h, supports SMS verification for high-value orders or when logging in from a new device. For more on this platform, see our PChome 24h guide.

While SMS is the most common method in Taiwan, it is still far better than no 2FA. If a service offers an authenticator app option, use that instead.

Best Practices for Managing 2FA

To avoid being locked out and to maintain security, follow these guidelines:

  • Always save backup codes. Most services provide 8-10 one-time backup codes when you enable 2FA. Print them and store them in a safe place, or save them in a password manager like Bitwarden or 1Password.
  • Use a password manager. Password managers can store TOTP secrets and generate codes for you, but this puts all your eggs in one basket. Many security experts recommend keeping your 2FA separate from your password manager for critical accounts (email, banking).
  • Have at least two second-factor devices. For example, register both your phone and a hardware security key with Google. If you lose your phone, you can use the key to log in and remove the lost phone.
  • Enable 2FA on your email first. Your email account is the key to resetting passwords for most other accounts. If an attacker takes over your email, they can reset your banking, social media, and shopping accounts.
  • Consider a hardware key for your most important accounts. A YubiKey 5 NFC costs about NT$1,800 on PChome or Shopee. It works with Google, Microsoft, Facebook, Twitter, GitHub, and many password managers.

Common Myths and Misconceptions

“2FA is too complicated for everyday use.” Modern authenticator apps and push notifications take only a few extra seconds. Once set up, you typically only need to enter a code when logging in from a new device or after clearing cookies.

“I don’t have anything worth stealing.” Attackers often use compromised accounts to send spam, launch phishing attacks, or impersonate you to scam your friends and family. Your account has value even if you don’t think so.

“SMS is good enough.” While SMS 2FA is better than nothing, SIM-swapping attacks are increasingly common. In 2023, a Taiwanese victim lost over NT$1 million after a SIM swap allowed attackers to bypass his bank’s SMS 2FA. Use an authenticator app or hardware key where possible.

How 2FA Affects Your PC and Device Buying Decisions

When choosing a new laptop or building a PC, consider how you will use 2FA. For example:

  • If you plan to use a hardware security key, ensure your computer has a USB-A or USB-C port. Many modern ultrabooks only have USB-C ports, so you may need an adapter or a key with both USB-C and NFC.
  • Windows Hello facial recognition or fingerprint reader can serve as a convenient second factor for logging into your PC. Many student laptops and gaming laptops under NT$40,000 now include fingerprint readers.
  • If you build a mini-ITX PC, you may have limited front-panel USB ports. A security key with NFC can be tapped against your phone instead of plugging into the PC.
  • For a high-end workstation used for sensitive work, consider a motherboard with a TPM 2.0 module (already standard on most modern boards) to enable BitLocker drive encryption, which works alongside 2FA.

What to Do If You Lose Your Second Factor

If you lose your phone or hardware key, immediately:

  1. Log in to the account using a backup code or another registered device.
  2. Remove the lost device from your trusted devices list.
  3. Add a new second factor (e.g., a new phone or a new security key).
  4. Generate new backup codes and store them safely.

If you have no backup codes and no other registered device, account recovery can be difficult. Google, Microsoft, and Apple all have account recovery processes that can take days and require you to verify your identity through other means (e.g., answering security questions, providing a government ID). To avoid this, always save backup codes.

Conclusion

Two-factor authentication is one of the most effective steps you can take to protect your online accounts. It is free, quick to set up, and supported by virtually every major service. Start with your email account, then enable 2FA on your banking, social media, and any accounts tied to your PC building purchases. Use an authenticator app or hardware key rather than SMS when possible. Save your backup codes. And when you shop for your next laptop or PC components, consider how you will use 2FA, a small investment in a hardware key or a laptop with a fingerprint reader can save you from a major headache later.

Related Articles