81% of hacking-related security breaches are due to stolen, reused, or weak passwords, according to Verizon’s annual Data Breach Investigations Report. It’s rarely a sophisticated technical failure — almost always, it’s a password someone already had written down somewhere else. And yet, a solution that drastically reduces this risk has existed for 40 years. This is the story of how it made its way to everyone’s phone.
Who invented two-step verification, and when
The idea of requiring two separate proofs of identity to access a system wasn’t born on the internet — it started in banking and the military in the 1980s. The inventor has a name: Kenneth P. Weiss, an engineer who in 1984 founded a company called Security Dynamics with a very specific idea: a small physical device, about the size of a key fob, that displayed a different number every minute. That number had to match exactly what the server calculated at that same instant — if it matched, identity was confirmed.
That device was called SecurID, and by the late 1980s it was being sold to banks, government agencies, and large corporations — the U.S. Department of Defense and several federal agencies were among its earliest customers. In 1993, Security Dynamics acquired a small encryption company called RSA, and over time the company itself became known as RSA Security — which is why those devices are still known today as “RSA tokens.”
The moment it became an open standard
Google Authenticator didn’t invent a system from scratch: it implemented a draft standard that a group of security companies (the OATH alliance, Open Authentication) had been developing together for some time, specifically so that anyone could build compatible apps without depending on a single brand. In May 2011, that draft was formalized as an official internet standard under the name TOTP (Time-based One-Time Password, technical document RFC 6238). Since then, Microsoft Authenticator, Authy, and virtually any app of this kind that exists today literally “speak the same mathematical language,” even though a different company makes each one.
A bit of context: why the password alone stopped being enough
The password as a way to access a computer system dates back to 1961, at MIT, to divide the usage time of a shared computer among several users. At the time it made sense: few people, few systems, and nobody thinking about stealing it on a massive scale. Sixty years later, the average person manages dozens of online accounts, and the temptation to reuse the same password across several of them is nearly universal — according to various password manager studies, more than 60% of users admit to reusing passwords between services.
That habit is precisely what breaks the model: when any service suffers a breach (and it happens constantly, at companies of every size), that same username-and-password combination gets automatically tried against thousands of other sites — an attack known as credential stuffing (automatically trying a leaked password against hundreds of different sites at once). Your WordPress doesn’t have to have been attacked directly to be affected: it’s enough that you reused, somewhere, a password that leaked on a completely different site.
What two-factor authentication (2FA) actually is, explained without jargon
2FA (short for Two-Factor Authentication) means, in practice, being asked for two different proofs that you are who you say you are, not just one. Information security classifies those proofs into three categories:
| Category | Everyday example | Weak point |
|---|---|---|
| Something you know | Your password, a PIN | Can be stolen, leaked, or guessed without you noticing |
| Something you have | Your phone, with an app that generates a code | Requires the physical object with you at that moment — which is exactly why it’s so effective |
| Something you are | Your fingerprint or your face | Less common on websites, more common for unlocking the phone itself |
2FA requires combining two different categories from the table above — two passwords aren’t enough, and neither are two security questions; that’s still “something you know,” repeated twice. To log in you need the password (category 1) and, in addition, the code that only your physical phone generates at that exact moment (category 2). An attacker having your password alone is no longer enough to get in.
How the code that changes every 30 seconds works (no complicated math)
When you set up 2FA with an app like Google Authenticator, your server and your phone agree on a shared secret at the moment of setup — that’s what the QR code you scan the first time actually does, it’s a convenient way to transmit that secret without having to type it in by hand. From then on, both — completely independently, with no need for the phone to have an internet connection — calculate the same 6-digit code using that secret combined with the current time. Since both clocks are synchronized, they both arrive at the same number without communicating in real time, every 30 seconds. It’s literally the result of a mathematical formula applied to the exact moment you look at it — nothing magical, just a calculation that only you and the server can reproduce, because only the two of you know the starting secret.
Which attacks 2FA blocks (and the one it doesn’t)
| Type of attack | What it involves | Does 2FA block it? |
|---|---|---|
| Credential stuffing | Trying passwords leaked from another site | Yes — without the second factor, no access |
| Brute force / dictionary | Automatically trying thousands of common passwords | Yes — guessing the password is no longer enough |
| Keylogger on a shared computer | Software that records what you type | Yes — it captures the password, but not the code from your phone |
| Very sophisticated real-time phishing | A fake site that relays your code to the attacker within the same second | Not entirely — rare, but it exists |
That’s why 2FA is one more layer of protection, not a magic barrier that replaces all the others — but it covers, by far, the most common and cheapest-to-execute scenario for an attacker.
Why SMS is the weakest method of all (and why many already avoid it)
For years, receiving the code by SMS was the most widespread standard, because it didn’t require installing anything. Today it’s considered the weakest link among the usual methods, because of a specific attack: SIM swapping. An attacker convinces your phone carrier that “they are you” — sometimes using personal data obtained in a previous breach — and gets your phone number transferred to a SIM card they control. From that moment on, every SMS meant for you — including 2FA codes — reaches them, not you, without your phone visibly stopping working.
That’s why NIST (the U.S. technology standards institute) has advised against SMS as a second factor since 2016, recommending authenticator apps instead as a much more robust alternative: the code is generated on your own device, without ever passing through the carrier’s network at any point in the process.
| Method | Ease of use | Security level | Main weak point |
|---|---|---|---|
| SMS code | Very high — nothing to install | Low | SIM swapping |
| Authenticator app (TOTP) | High, after a 1-minute setup | High | No serious known issue for normal use |
| Email code | Very high — no new apps needed | Medium-High | Depends on your own email being well protected |
| Physical security key (FIDO2/U2F) | Medium — you need to buy and carry the device | Very high | Cost and risk of losing the physical key |
So why doesn’t everyone use it yet?
The main reason isn’t technical, it’s friction: enabling 2FA feels like “one more step,” and many people put it off until it’s too late. The paradox is that this extra step takes less than a minute the first time, and after that it’s almost invisible in daily use — you scan the code once and you’re done, there’s no need to repeat the process on every visit.
Frequently asked questions
Does 2FA protect me if my password has already been leaked?
Yes, and this is precisely the scenario where it makes the biggest difference: even if an attacker has your exact password, without the second factor they can’t complete the login.
Can an attacker bypass 2FA if they steal my phone physically?
Only if they also have your password and manage to unlock the phone (fingerprint, PIN, or face) — that’s three separate barriers at once, not one. It’s a far less likely and far more costly scenario for an attacker than stealing a leaked password from the other side of the world, which is how most real “hacking” actually happens.
Do I need an internet connection on my phone to generate the code?
No — and that’s one of the most underrated advantages of TOTP over SMS. The code is calculated locally on the phone from the shared secret and the time, without sending or receiving anything over the network. It works the same way in airplane mode.
Can I lose access if I lose my phone?
That’s exactly why most serious systems offer an alternative recovery method (backup codes, a second factor by email) — it’s worth setting up on day one, not when you already need it.