Recently, it was announced that Twitter would only offer SMS-based two-factor authentication (2FA) to its Twitter Blue members<\/a> (those who are willing to pay $8 a month on Android or $11 a month on iOS). To tell you the truth, my first reaction was: just as well. If you want to use 2FA to secure your social media or another account, using text messaging is not the way to go. You\u2019re much better off using either a third-party authenticator app or a hardware security key.<\/p>\n<\/div>\n Security keys, such as the ones sold by Yubico<\/a>, are the safest method to use. They can connect to your system using USB-A, USB-C, Lightning, or NFC, and they\u2019re small enough to be carried on a keychain (with the exception of\u00a0Yubico\u2019s YubiKey 5C Nano<\/a>, which is so small that it\u2019s safest when kept in your computer\u2019s USB port). They use a variety of authentication standards: FIDO2, U2F, smart card, OTP, and OpenPGP 3.<\/p>\n<\/div>\n When you insert a security key into your computer or connect one wirelessly, your browser issues a challenge to the key, which includes the domain name of the specific site you are trying to access (which prevents you from accidentally logging in to a phishing site). The key then cryptographically signs and allows the challenge, logging you in to the service.<\/p>\n<\/div>\n Many sites support U2F security keys, including Twitter, Facebook, Google, Instagram, and others. The best thing to do is check the website of your security key of choice and see which services are supported \u2014 for example, here\u2019s a link to the\u00a0apps supported by YubiKeys<\/a>.<\/p>\n<\/div>\n But while physical security keys are the safest method, they are not the most convenient. If you don\u2019t want to carry around (and possibly lose) a physical key, using an authentication app on your phone is the best way to go. <\/p>\n<\/div>\n Authentication apps generate one-time numerical passcodes that change approximately every minute. When you log in to your service or app, it will ask for your authenticator code; you just open up the app to find the randomly generated code required to get past security.<\/p>\n<\/div>\n Popular options include Authy<\/a>, Google Authenticator<\/a>, and Microsoft Authenticator<\/a>. These apps mostly follow the same procedure when you\u2019re adding a new account: you scan a QR code associated with your account, and it is saved in the app. The next time you log in to your service or app, it will ask for a numerical code; just open up the authenticator app to find the randomly generated code required to get past security.<\/p>\n<\/div>\n Here is how to set up 2FA on some of the more popular online accounts. Not all of them allow for authenticator apps; in that case, we list what is available. (If you\u2019re just interested in using an authenticator app for your Twitter account, you can go directly to this article<\/a>, which gives you all the steps needed \u2014 however, just to be convenient, we\u2019ve included Twitter with the others here.)<\/p>\n<\/div>\n Note: most of the following directions are for websites; if you can use a mobile app, directions will be given for that as well.<\/p>\n<\/div>\n If you wish, you can also register a phone number to use as a backup text 2FA. Amazon also lets you opt out of 2FA for any specific devices.<\/p>\n<\/div>\n You can also activate 2FA on the Android and iOS Amazon apps.<\/p>\n<\/div>\n If you use any Apple devices, you turn on 2FA through your Apple ID \u2014 you can do it either on your mobile device or on the web. You also receive any verification codes via Apple\u2019s system; there are no third-party authentication apps here. (Apple recently added the ability to use physical security keys<\/a> if you have an iPhone on iOS 16.3 or later, an iPad on iPadOS 16.3 or later, or a Mac on macOS Ventura 13.2; you will need to have at least two keys in order to use this feature.)<\/p>\n<\/div>\nWhat are security keys?<\/h4>\n<\/p>\n
What are authenticator apps?<\/h4>\n<\/p>\n
Amazon<\/h3>\n<\/p>\n
\n
\n
Apple iOS \/ macOS<\/h3>\n<\/p>\n