Enable two-factor authentication on email, payment, and social accounts; prioritize phone pop-ups over SMS codes
Original: eternity4719 · source details
Original author: eternity4719 · Chinese source: · English adaptation: parveen0029. Translation and grade notes ↗
Bibliographic titles are retained in their original language.
Source author's views and grades; not individually verified by this site.
Cost and benefit at a glance
- Check the cost Cost ↓
- No cost involved. Each account takes just two to three minutes to set up once.
- Then the source benefit Benefit ↓
- Google analyzed 350,000 real-world account hijacking attempts. For authentication methods relying on device verification — such as phone pop-ups or physical security keys — over 94…
In plain terms
Two-factor authentication means an extra verification step beyond the password when logging in. Using a pop-up prompt on your phone that requires a single tap to confirm blocks over 90% of phishing and account theft attempts. In contrast, older verification methods such as answering questions like “Where did you log in last time?” or “What is your backup email?” only block around 10% of such attacks.
This guide's cartoon · show illustration
Enlarge illustrationOriginal illustration with Chinese lettering; the English dialogue is below. Humour is a reading aid, not evidence.
English dialogue
- One password for everything?
- So every door takes the same key?
Cost: what it takes
No cost involved. Each account takes just two to three minutes to set up once.
Benefit: what the source reports
Google analyzed 350,000 real-world account hijacking attempts. For authentication methods relying on device verification — such as phone pop-ups or physical security keys — over 94% of phishing-related hijacking attempts and 100% of automated hijacking attempts were prevented. These automated attempts involve bots using leaked passwords to try logging into accounts in bulk. For verification based on answering personal questions, only 10% of phishing attempts and 73% of automated attempts were blocked.
Conditions, limits and disagreements
The same study also found that these verification methods occasionally block legitimate users from accessing their accounts. 52% of real users failed to log in on their first try. However, 97% of them eventually gained access. It is recommended to enable this feature on email accounts first, as most other accounts allow password recovery via email.
Original references
Original bibliographic titles and links are preserved; some titles are in Chinese.
Doerfler P, Thomas K, Marincenko M, et al. (2019). Evaluating Login Challenges as a Defense Against Account Takeover. The World Wide Web Conference (WWW '19). https://doi.org/10.1145/3308558.3313481
Medical, legal, financial and policy conditions vary by person, place and time. Policy material primarily concerns mainland China; check the cited document and current local requirements.