Why Multi-Factor Authentication Is Non-Negotiable

Passwords leak. They leak from breached databases, phishing pages, keyloggers, and reused logins on sites you forgot you signed up for. Multi-factor authentication (MFA) is the control that keeps a leaked password from being game over: an attacker who has your password still needs a second factor they don't possess.

Not all MFA is equally strong

SMS codes are better than nothing, but they're vulnerable to SIM-swapping, where an attacker convinces your carrier to port your number to a device they control. Use SMS as a fallback, not your primary method.

Authenticator apps (generating time-based one-time codes) are a solid default. The code lives on your device, not on the cellular network, which closes the SIM-swap hole.

Push notifications from an app are convenient but can be defeated by "MFA fatigue" attacks, where an attacker spams approval requests hoping you'll tap accept out of annoyance. If you use push-based MFA, always check the request details — the app or location it's coming from — before approving, and deny anything you didn't initiate.

Hardware security keys and passkeys are currently the strongest option available. They're resistant to phishing because the cryptographic proof is tied to the actual website domain — a fake login page simply can't complete the handshake, even if you're fooled into visiting it.

Where to turn it on first

Prioritize by blast radius. Your email, your password manager, and your primary cloud storage account should be first, because compromising any of them typically opens the door to everything else through password-reset flows.

1. Primary email
2. Password manager
3. Banking and financial accounts
4. Cloud storage and backups
5. Social media accounts

Save your recovery codes

When you enable MFA, most services generate one-time backup codes for the case where you lose your second factor. Save them somewhere durable and offline — printed, or in an encrypted note — not in the same inbox that MFA is protecting. Losing both your device and your recovery codes at once is how people get permanently locked out of their own accounts.

MFA adds a few seconds to your login. That's a trivial cost compared to what it prevents.