Security, Abuse & Privacy

Two-Factor Authentication

Definition

Two-factor authentication, written 2FA, asks for evidence from two different categories: something you know, something you have, or something you are. In practice the first factor is a password and the second is one of four things. An authenticator app generates a six-digit time-based code that changes every thirty seconds, a scheme defined in RFC 6238 and shared with the site as a QR code when you enrol. A passkey or security key uses WebAuthn, where the device holds a private key and signs a challenge from the site, which means nothing reusable is ever typed. A code by SMS is the weakest of the group, because numbers can be moved to another SIM by someone persuasive enough on a phone call. Recovery codes are the fallback, a short list of one-time strings printed at setup and intended for the day the phone is lost.

Why It Matters

Password reuse is the ordinary route into an account: a database from an unrelated site leaks, the same password was used here, and an automated attempt walks straight in. A second factor breaks that chain, and the published figures are striking — Google reported that an on-device prompt blocked essentially all automated bot attacks and the large majority of targeted ones in its own measurements. For a hosting account the stakes are specific: whoever controls it can replace a live page with anything at all at an address your clients already trust, which is a far worse outcome than a leaked file. Passkeys add one more thing SMS and app codes cannot, since the signature is bound to the site's domain and a convincing copy of the login page receives nothing worth stealing. The inconvenience is a few seconds per sign-in.

How It Works

Enrolment with an authenticator app exchanges a shared secret, usually by QR code, from which both sides compute the same code from the current time in thirty-second steps, with a small tolerance for clocks that drift. WebAuthn works differently: the site sends a random challenge, the device signs it with a private key released by a fingerprint or a PIN, and returns that signature, and the site checks it against the public key registered earlier — no secret is transmitted at any point. Sessions are normally remembered per device for a set period, so the second factor is not requested on every visit. API access sits outside this flow, because a script cannot type a code, which is why an API token is issued separately and should be scoped and rotated rather than treated as a permanent key. Enrolment, disablement and recovery events all belong in the audit log, since turning 2FA off is exactly what an intruder does first.

Real-World Example

A freelancer keeps client deliverables on an account that publishes to addresses such as northgate-deck.99helpers.site, and an old password of theirs turns up in a breach collection. Sign-in attempts from two countries fail at the second factor, and the notification is the first the freelancer hears of it. Changing the password takes a minute; the accounts without a second factor elsewhere take the rest of the afternoon. Note what 2FA protects here — the 99helpers account itself, not the published files, since a password on a shared link is a different control with a different job.

Common Mistakes

  • Relying on SMS where the account matters — a SIM swap moves the number to the attacker and the code arrives on their phone
  • Storing recovery codes in the same password manager as the password — one compromise then hands over both factors at once
  • Turning it on for the owner and not for the contractor with publishing rights — the weakest login on the account sets the standard for all of it

Related Terms

Put a file online in seconds

Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.

Host a file free →