How does two-step verification protect accounts?

1. Milo opens his pretend owl club account with a password. But Rocco the raccoon was listening. Now Rocco knows the password too. Is the account lost?
2. The fix is a second lock. The first lock opens with something you know: the password. The second opens with something you have: your own phone.
3. After the password, Milo's phone shows a six-digit code. He types it in and the second lock opens. The code works only once, and a new one appears every 30 seconds.
4. When Milo set it up, his phone and the club's computer saved the same secret. Each mixes that secret with the time. They get the same code without sending any message.
5. Rocco types the stolen password and the first lock opens. But he does not have Milo's phone, so he cannot get the code. A guess has one chance in a million.
6. One trick is left: asking you for the code. No real helper ever needs it. If a message or a caller asks for your code, do not share it, and tell a grown-up.

Tap each part of the pretend club door and Milo's phone.

• First lock: the password. The first lock checks something you know: your password. It is a good start, but a password can be guessed, overheard or copied.
• Second lock: your phone. The second lock checks something you have: your own phone. A thief far away cannot reach into your pocket.
• One-time code. The code is six digits long and works just once. After you use it, or after its time runs out, it is useless to anyone.
• The 30-second clock. The ring shows how long the code will last. Every 30 seconds the old code stops working and a new one appears.
• Shared secret. When two-step is switched on, the phone and the club's computer save the same secret. It is the recipe for all the codes, and it never leaves them.
• The checker. The club's computer checks the password first and then the code. It works out the code for itself and compares. Only when both are right does the door open.

Log in as Milo: tap the first lock, then the phone. Then choose Rocco, who knows the password but has no phone. Switch two-step off and on and see what changes.

Experiment: Rocco knows Milo's password. With two-step verification switched on, can he get in?

1. Choose Milo and press Log in. Both locks open.
2. Choose Rocco and press Log in. Watch the second lock.
3. Switch two-step off and let Rocco try again.

What we found: With two-step on, the password opens only the first lock. Rocco has no phone, so he cannot make the code and stays outside. With two-step off, the stolen password alone lets him in.

Turn on JavaScript to try it yourself.

Five visitors and messages arrive. Let in only someone with the right password and a fresh code from the phone. And never give a code away.

A password is something you know. That is handy, but it has a weakness: someone else can know it too. They might guess it, watch you type it, or find it in a list stolen from a website. And you cannot see that it has been copied.

Two-step verification adds a second proof of a different kind: something you have. Usually that is your phone. After the password, the account asks for a short code that only your phone can show. A thief on the other side of the world does not have your phone, so the stolen password is not enough.

The code is clever. Your phone and the website share a secret from the day you set it up. Both mix that secret with the time, so both get the same six digits without sending them anywhere. Every 30 seconds the code changes, and each code works only once.

One rule keeps all of this working: never give a code to anybody. Real helpers do not ask for it. If a message, a caller or a page you did not expect asks for your code, stop and tell a parent or another grown-up you trust. They can also help you switch two-step on.

Key words

Two-step verification

Signing in with two proofs, such as a password and a code from your phone.

Factor

A kind of proof: something you know, something you have, or something you are.

One-time code

A short number that works for one sign-in only.

Authenticator app

An app on your phone that shows the one-time codes for your accounts.

Phishing

A trick message or page that pretends to be someone you trust, to get your secrets.

Check your thinking

1. What are the two proofs in two-step verification?

   Show the answer

   Something you know and something you have. A password is something you know, and your phone is something you have. They are different kinds of proof.

2. A message says: this is your game club, please send us the code on your phone. What should you do?

   Show the answer

   Do not send it, and tell a grown-up. A real service never asks for your code. Whoever asks is trying to get into your account.

3. A thief learns your password but does not have your phone. With two-step on, what happens?

   Show the answer

   The first lock opens, but the second stays shut. The password is only one of the two proofs. Without the code from your phone, the thief is stuck.

4. Why does the code on the phone change every 30 seconds?

   Show the answer

   So a code that someone sees or copies soon stops working. A short life means a stolen code is useless almost at once.

5. A page that looks like your club's login asks for your password and code, but its address is slightly different. What is the risk?

   Show the answer

   The fake page can pass both to the real site at once and sign in as you. A typed code can be relayed within its 30 seconds. Check the address, and prefer security keys or passkeys, which will not answer a look-alike site.