IT·Science Talk

PSA: use an authenticator app for 2FA, not SMS codes, if you can

I do IT support and I spend a surprising part of my week helping people who got locked out or got their accounts taken over. Quick list of what I tell everyone:

1. Turn on two-factor login for your email first. Your email is the master key to everything else, because every 'forgot password' link goes there.

2. Use an authenticator app or a passkey where offered. Text-message codes are better than nothing, but SIM-swap scams exist, where someone talks your phone company into moving your number to their SIM.

3. Save your backup codes somewhere that isn't your phone. Print them, put them in a drawer. Most lockouts I see are people who lost their phone and had no backup codes.

Questions? Ask away. What do you all use?