I’ve been trying to improve my online accounts’ security and privacy as of late, and one major action I’m able to do for the former is setting up two-factor-authentication on as many accounts of mine as possible. I feel like even my randomized and special character containing 20 character passwords are still somewhat vulnerable to cracking or leakage. Why shouldn’t I be more secure when I’m quite easily able to? Now, there are 7 ways I’m able to approach 2FA:
- Scan QR codes or add TOTP secret keys to a local accountless app on my phone
- Scan QR codes or add TOTP secret keys to a cloud-synced via account app on my phone
- Scan QR codes or add TOTP secret keys to the respective login in my password manager
- Add my phone number and have temporary SMS codes sent to it (imagine this is struck out)
- Save a passkey in my password manager
- Save a passkey on a physical device (very uneducated on how this works)
- Ignore 2FA altogether and set 100 character random passwords (basically un-brute-forceable?)
I’ve already learned via Privacy Guides (as well as other sources) that SMS are unencrypted and can be intercepted through the one or multiple cell providers that they go through. I currently have a bunch of my online accounts set up to receive SMS codes as an additional way to 2FA, but I’ll work on removing those less secure options.
Methods 1-3 seem relatively similar in security to me, although each following one slightly less secure than the last. Conveniently, my password manager (protected by not one, but two passwords, one of which I don’t have saved anywhere except physically written down at home) offers a way to add and generate TOTP codes for each login. Additionally, they appear as pop-ups on desktop and notifications on mobile, both of which appear when I’m presented with a 2FA challenge during the login process and let me quickly see and copy the code. I’ve moved all my code generation to my recently acquired new password manager as it is a lot more convenient to not have to open a separate mobile-only app on my phone, but that could be less secure than the latter less convenient way.
TOTP codes saved locally on my phone feel more secure than those saved on my phone but synced via an account and/or iCloud. PS. I should probably save the backup codes either physically printed or saved in a secure cloud storage rather than as notes/file attachments in my main password manager, right?
By the way, are Google Authenticator and Microsoft Authenticator apps on mobile good tools to do that? I really don’t trust either corporation at all, but my accounts on them are quite secure (besides currently allowing 2FA through SMS on them).
Passkeys seem like a relatively new security feature that have been more and more widely adopted, but I’m not well-informed on how they work, and they feel less secure than TOTP codes to me. I’ve been instinctively adding them (before starting my new security improvement journey) to every account I had that allowed it, but you’re telling me I can input my e-mail address and then submit the website the saved passkey and skip any password and 2FA input? Seems quite suspicious and vulnerable to me. Although less so if they were saved on some physical device in my possession, like a USB stick, although I’d have to find one compatible with my PC, my phone, and my tablet (not all of them have USB-C connectivity).
What would you say is the most secure and/or most recommended by you way of approaching two-factor-authentication of online accounts? I might be reaching paranoid levels of overthinking, cause my threat model level isn’t very high, but I wish to be more informed and generally make the best decisions for my online security. A simple ranking would suffice as an answer, but I’d be most grateful if you could also explain to me the strengths and weaknesses of each 2FA method as well as answer the various questions I have on the topic, such as whether it makes a difference what TOTP app I use or if I sync by TOTP codes across devices or only generate them on my phone.
