Some sites specifically ask you to use Google Authenticator, you don’t have to. When you enable two-factor authentication on websites, they usually show you a QR code and ask you to scan and launch your authenticator app. I think it is a terrible idea to use them, you are basically collapsing all the factors back into one - your master password. Some password managers like LastPass and BitWarden provide authenticator functionality as well. Indeed, if you use the authenticator app on your smartphone you may also get the third factor for free, by needing to pass your smartphone’s biometric authentication before launching the authenticator app. Something you are: Things that prove the user is the person they claim to be - usually biometric factors (Fingerprint, Face ID, etc.)Ī lot of websites provide 2FA by taking the password as the “something you know” and the token generated by the authenticator as the “something you have”.Something you have: Things in the users’ possession, e.g., smartphones, hardware tokens.Something you know: Password, security questions, PINs.

There are the main three categories of information:

Multi-factor authentication (MFA) adds extra levels of defense by asking the user to provide additional pieces of information apart from the password. It has been known that passwords are not good enough.

Onetime password