Two-Factor Authentication
Definition
Two-factor authentication, written 2FA, asks for evidence from two different categories: something you know, something you have, or something you are. In practice the first factor is a password and the second is one of four things. An authenticator app generates a six-digit time-based code that changes every thirty seconds, a scheme defined in RFC 6238 and shared with the site as a QR code when you enrol. A passkey or security key uses WebAuthn, where the device holds a private key and signs a challenge from the site, which means nothing reusable is ever typed. A code by SMS is the weakest of the group, because numbers can be moved to another SIM by someone persuasive enough on a phone call. Recovery codes are the fallback, a short list of one-time strings printed at setup and intended for the day the phone is lost.
Why It Matters
Password reuse is the ordinary route into an account: a database from an unrelated site leaks, the same password was used here, and an automated attempt walks straight in. A second factor breaks that chain, and the published figures are striking — Google reported that an on-device prompt blocked essentially all automated bot attacks and the large majority of targeted ones in its own measurements. For a hosting account the stakes are specific: whoever controls it can replace a live page with anything at all at an address your clients already trust, which is a far worse outcome than a leaked file. Passkeys add one more thing SMS and app codes cannot, since the signature is bound to the site's domain and a convincing copy of the login page receives nothing worth stealing. The inconvenience is a few seconds per sign-in.
How It Works
Enrolment with an authenticator app exchanges a shared secret, usually by QR code, from which both sides compute the same code from the current time in thirty-second steps, with a small tolerance for clocks that drift. WebAuthn works differently: the site sends a random challenge, the device signs it with a private key released by a fingerprint or a PIN, and returns that signature, and the site checks it against the public key registered earlier — no secret is transmitted at any point. Sessions are normally remembered per device for a set period, so the second factor is not requested on every visit. API access sits outside this flow, because a script cannot type a code, which is why an API token is issued separately and should be scoped and rotated rather than treated as a permanent key. Enrolment, disablement and recovery events all belong in the audit log, since turning 2FA off is exactly what an intruder does first.
Real-World Example
A freelancer keeps client deliverables on an account that publishes to addresses such as northgate-deck.99helpers.site, and an old password of theirs turns up in a breach collection. Sign-in attempts from two countries fail at the second factor, and the notification is the first the freelancer hears of it. Changing the password takes a minute; the accounts without a second factor elsewhere take the rest of the afternoon. Note what 2FA protects here — the 99helpers account itself, not the published files, since a password on a shared link is a different control with a different job.
Common Mistakes
- ✕Relying on SMS where the account matters — a SIM swap moves the number to the attacker and the code arrives on their phone
- ✕Storing recovery codes in the same password manager as the password — one compromise then hands over both factors at once
- ✕Turning it on for the owner and not for the contractor with publishing rights — the weakest login on the account sets the standard for all of it
Related Terms
Audit Log
A record of who did what inside an account — logins, uploads, deletions, permission changes, tokens created. It answers questions about the people with keys, not about the visitors.
API Token
A secret string that identifies your account to an API in place of a username and password. You send it with each request, and the service checks it and applies whatever permissions it carries.
Access Control
The rules deciding who may reach a file or page and what they may do once they are there. It combines proving identity with checking permission, and the two are separate jobs.
Password-Protected Link
A hosted address that asks for a shared secret before it will show the file or site behind it. One password covers everyone who has the link; there are no individual accounts.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →