Two-factor Authentication

Two-factor authentication asks for a second proof as well as your password. The two proofs must be different kinds, called factors: the password is something you know, and the second proof is usually something you have, such as a small keyring device that shows a new number every 30 seconds, or a smart card that you tap on a reader. Typing a second password does not count, because that is the same kind of proof as the first.

It helps because a guessed or stolen password on its own is not enough. If an attacker works out your password, they still cannot log in without the second proof. That proof is a separate object they would also have to steal or copy, so the account is much harder to break into.

For example, imagine the treasurer of a youth football club uses an online banking account to pay for new kit. The account asks for a password and then a one-time code from a keyring token kept in the treasurer's pocket. Someone who has watched the treasurer type the password over their shoulder still cannot move any money, because they do not have the token. The stolen password alone does nothing.

Two-factor authentication is a valid extra layer of protection, but the prevention methods used to keep a network secure are passwords, user access levels and physical security, and two-factor authentication is an example you can use alongside them.