Glossary / Privacy & security
Two-factor authentication
Also known as 2FA.
- Definition
- Two-factor authentication makes an account require a second proof besides your password, so a leaked or guessed password on its own no longer opens your exchange account.
The three usual factors are something you know, something you have, and something you are, and a real second factor must come from a different category than the first. Google's research on account hijacking found that an on-device prompt blocked 99 percent of bulk phishing attempts and 90 percent of targeted ones, while codes sent by text managed 96 and 76 percent. On an exchange, all of this guards the account, never the coins.
How it works
Two-factor authentication turns login into two independent claims, and the whole value of it lies in how independent they really are.
Codes from an app (TOTP). The standard is RFC 6238, published in May 2011 on top of the older HOTP scheme from 2005. At setup, the service shows you a QR code containing a shared secret, typically 160 bits. From then on, both your phone and the server compute an HMAC over that secret and the current 30-second time step, truncate it to six digits, and compare. Nothing travels over the network to produce the code, which is why an app survives a SIM swap that would defeat text messages.
The consequence people miss is that the secret is copyable. Screenshot the setup QR code and your second factor now lives wherever your photos sync. Store the TOTP secret in the same password manager entry as the password and you have two codes protected by one master password, which is one factor wearing a costume.
Codes by text message. The code travels through the phone network and depends on a carrier employee not being fooled or paid. NIST's SP 800-63B classifies one-time codes sent over the public telephone network as a restricted authenticator, meaning services that use them must acknowledge the risk. Text-message codes are still far better than nothing.
Security keys and passkeys (FIDO2, WebAuthn). Here the authenticator generates a key pair per website, keeps the private key, and signs a challenge that includes the site's origin. The signature is worthless to any other domain, so a lookalike login page collects nothing it can replay. WebAuthn became a W3C Recommendation in March 2019 and is supported by every major browser. A passkey is the same protocol with the credential synced across your devices instead of locked to one piece of hardware.
Recovery is the fourth factor nobody configures. A perfect security key means little if the account can still be reset by email and a text message. Attackers know to attack the recovery path, not the login.
Why this matters when you buy bitcoin
Two-factor authentication protects an account, and an account is a claim on a company. Keep that distinction in front of everything else on this page.
Set it up in this order on any exchange you use. Choose a long unique password. Enrol a security key if the venue supports one, otherwise an authenticator app, and never text messages as your primary factor. Then open the account recovery settings, which are usually a separate page, and remove the phone number as a reset method. Print the backup codes onto paper and put them somewhere your house fire would not reach. Finally, add a withdrawal address whitelist so that a compromised session cannot invent a destination.
Then deal with the blind spot. API keys bypass login entirely, and with it every factor you just configured. A trading bot, a portfolio tracker, or a tax tool that once asked for read access may hold a key that never expires. Review the API section of every exchange account you have, delete keys you do not recognise, refuse withdrawal permission on anything, and bind keys to a fixed IP address where the venue allows it.
The exchanges reviewed on this site differ in what they offer. Kraken and Coinbase support hardware security keys and passkeys. Bitstamp, Binance, and Bitpanda support authenticator apps at minimum. River and Swan, both built around recurring buys, lean on account-level controls rather than trading APIs, which removes a whole category of exposure. None of these differences change the endgame: buy, then withdraw to a wallet you control, where there is no login to defend.
A hardware wallet is not protected by two-factor authentication and does not need to be. Its equivalents are the device PIN, which wipes after a fixed number of wrong attempts, and an optional passphrase.
What the measurements actually show
Google, working with New York University and the University of California San Diego, studied real hijacking attempts against Google accounts and published the results in May 2019.
The numbers are worth reading as a ranking rather than as absolutes. Against automated bots, every method tested blocked 100 percent. Against bulk phishing, an on-device prompt blocked 99 percent and a text-message code 96 percent. Against targeted attacks, where a human is working on your account specifically, the on-device prompt held at 90 percent and the text-message code fell to 76 percent.
Read that last figure carefully. Roughly a quarter of determined attacks got through the most popular second factor in the world. Google's own answer for its workforce was to require physical security keys for more than 85,000 employees, after which it reported no confirmed account takeovers by phishing.
The practical translation for a bitcoin holder: any second factor beats none, an app beats a text message, and a security key is the only option that removes the phishing category rather than reducing it.
Two-factor authentication vs passphrase
A passphrase on a hardware wallet is often described as two-factor authentication for your bitcoin, and the analogy breaks in a way that costs people money. Two-factor authentication is a check performed by a company's server, which can be reset, appealed, and supported. A BIP39 passphrase is an input to the key derivation itself: a different passphrase produces a completely different set of keys, with no record anywhere that the other set exists. Nobody can verify it, nobody can recover it, and there is no support queue. Forget your exchange's second factor and you file a recovery request. Forget your passphrase and the coins are gone permanently, even though you still hold all twenty-four seed words.