- Digital Kleptos
- Posts
- Turning On Multi-Factor Authentication (MFA) Will Massively Increase Your Online Security
Turning On Multi-Factor Authentication (MFA) Will Massively Increase Your Online Security
Passwords alone won't protect your bank account, 401(k), or email. You need multi-factor authentication (MFA).
Anthony Collette
October 07, 2025 • Estimated Reading Time: 8 minutes
Happy Tuesday! This week we’ll wrap up our Brilliant At The Basics Of Cybersecurity series with a discussion of Multifactor Authentication (MFA) — a super-easy, additional security step you can take to keep your online accounts safe from hackers and other Digital Kleptomaniacs™. When logging in to an online account, what you’re really doing is proving it’s actually you trying to log in. That’s why passwords were originally designed, as a secret only you would know. |  |
But passwords by themselves aren’t enough for many of our most sensitive and important online accounts like email, banking, investment, cryptocurrency, etc.
There are various options you can choose to add this extra security layer. You can think of them as existing along a spectrum of good > better > best. A great strategy is to choose the strongest form of MFA each online account offers. If someone tries to hack into your online accounts, make it as difficult for them as possible.
— Anthony Collette
Founder, Loistava Information Security
What Is Multi-factor Authentication (MFA)?
MFA is a way to verify that it’s actually you trying to log in to an online account. And when you turn it on, your accounts are far more secure than with passwords alone.
Sites verify your identity by using a combination of different types of “factors”. When logging in, the site verifies:
Something You Know (a password or PIN)
Something You Have (a security key or phone), or
Something You Are (fingerprint or facial scan).
The whole point is to prove to the site that whoever is knocking on their door is actually the real owner of that particular online account.
All MFA Isn’t Created Equal
The goal is to prove that it’s really you, and not some Digital Klepto™ trying to hack into your account and steal something. There are various methods of accomplishing this, and some are better than others. They exist along a spectrum of good > better > best.
Let’s explore the options:
Text Messages (SMS)
This was the original or “legacy” method to add an extra layer of security to an online account. When you log in, the site sends a one-time code as a text message to your phone, then you type that code into the login page.
As long as you have a cellphone on hand, this option works fairly well, is familiar to most people, and adds zero financial cost to your online experience. Unfortunately, text messaging isn’t strongly resistant to hacking attempts, and is often the weak link in a hacking incident.
If it’s your only option, though, it’s still way better than no MFA at all.
Authenticator Apps
These specialized apps on your cellphone or workstation are more secure than text messages. When you attempt to log in, the site will require you to retype or copy and paste a code which appears in the app.
Although not terribly difficult to do, the process can be a bit confusing and add some friction. Authenticator apps are typically free to download, so cost isn’t a factor.
However, if you lose your phone or switch phones, this presents a difficult problem which requires time and effort to recreate the accounts you added to the Authenticator App.
Privacy-first email. Built for real protection.
End-to-end encrypted, ad-free, and open-source. Proton Mail protects your inbox with zero data tracking.
Hardware Security Keys
This option provides the best security for online accounts. They’re easy to set up and ridiculously easy to use. As you log in to a site, when the built-in light on the key blinks, you press the button. That’s it!
Cost of these hardware keys varies from about $20 to $60. Considering the low cost, it makes sense to buy two — one for daily use, and one as a backup. Since they last for years, when you spread the cost out, it’s just a few dollars per year. That’s an amazing bargain to gain online security.
Yubico’s YubiKeys are some of the most popular choices, although other brands are available. These fantastic little gizmos are available from online retailers like Amazon, or directly from Yubico.
This combination of Something You Know (a password or PIN), or Something You Have (a security key or phone) or Something You Are (fingerprint or facial scan) makes an enormous difference in online security. The cost is minimal and the success rate of better/best MFA is extraordinarily high.
Brilliant At The Basics Of Cybersecurity
We’re now living a huge portion of our modern lives online. Hackers and scammers are targeting all age groups and demographics. No cavalry is triumphantly galloping over the hill to save us, so it’s up to us to do what we can to make ourselves safer online.
Thankfully staying safe online doesn’t have to be hard or complicated. One by one, each of us can master The Basics:
✔ Know The Basics — Understand how the world has changed, and what you can do about it.
✔ Modern Passwords — Create and use strong, unique, Modern Passwords for each online account.
✔ Password Manager — Use a high-quality Password Manager to create, remember and type the passwords for your online accounts.
✔ Diceware Passphrase — Craft and use a Diceware Passphrase to lock down your Password Manager.
✔ Multi-factor Authentication (MFA) — Implement MFA for each online account that offers it.
There are no guarantees in life. But fortunately, these 5 foundational building blocks are proven to work extremely well. You can massively stack the deck in your favor by intelligently adding each one to your online experience.
This adventure in security doesn’t have to be hard or overwhelming. And you don’t need to do it all at once — brick by brick, layer by layer, add each one of The Basics to your day-to-day online life.
Then pop a cork! You deserve to celebrate what you’ve accomplished!
Join us
Weekly resources to help keep you safer online — protecting you from hackers, online scammers, and other Digital Kleptomaniacs™.
No spam. No selling your email. Just factual, actionable information once a week, from people who truly care about online security. You can unsubscribe any time — but we hope you’ll want to stay with us on this journey.
Cybersecurity is a modern form of wealth, and you deserve to keep what you've earned.
Looking forward to connecting again next week.
— Anthony Collette
Reply