Authenticator Apps: a Better Multi-Factor Option than Text or Email

When a website requires somebody to set up multi-factor authentication (MFA), it often provides multiple options such as:

• Email
• SMS (text)
• Authenticator app

Of the three, using an authenticator app is definitely the most secure approach. (Hardware authenticators such as a Yubikey will be a topic for another day.)

The Problem with Email as MFA

Email as the multi-factor authentication method is pretty bad. Just think of how many websites you visit where:

1. Your username is your email address, and
2. When you click the “forgot password” link, they just send an email with a reset password link.

If #1 and #2 are true and you use your email as the multi-factor method, if a thief gets into your email account, they can now access any of those other accounts as well.

Granted, a thief getting access to your email account is extremely bad news as it is. We want to take serious precautions to avoid that scenario. But there’s no reason to make that scenario any more disastrous than it needs to be.

SMS (Text) Isn’t Secure

Using SMS (text) as the multi-factor method is not ideal either.

CISA (the Cybersecurity and Infrastructure Security Agency, which is a component of the United States Department of Homeland Security) put out a document in December 2024 that encouraged people to “migrate away from SMS-based MFA.” They note that “SMS messages are not encrypted — a threat actor with access to a telecommunication provider’s network who intercepts these messages can read them.” They also note that SMS is not phishing-resistant (see the John/Rachel example).

SIM-Swap Fraud

Another problem with SMS at the multi-factor authentication method: SIM-swap fraud.

Mobile providers can easily “port” a phone number from one device to another. This is commonly done when a customer switches to a new phone (e.g., to upgrade or because the previous device was lost).

In a SIM-swap fraud:

• The thief gathers personal information about the target. As we’ve discussed, a lot of information is simply purchasable. Other assorted information can often be gathered via social media or online searches (e.g., mother’s maiden name may be findable via an obituary posting).
• The thief then contacts the target’s mobile provider and, with clever conversational skills and a bunch of personal (ostensibly private) information, convinces the company to transfer the target’s phone number to the thief’s device.

And now the thief has access to any MFA codes that come in via text. And again, as discussed recently, in many cases that code is all they need, in order to access various critical accounts.

Your mobile provider probably offers a SIM-swap protection feature. Verizon, T-Mobile, and AT&T all provide it free of charge, but it isn’t activated by default. I would definitely encourage you to turn it on.

Even with SIM-swap protection activated via your mobile provider though, SMS is still not the ideal method for multi-factor authentication, because SMS is not encrypted.

Authenticator Apps

Authenticator apps are more secure than SMS or email as the multi-factor method. The authenticator app is installed on your phone and cannot be accessed remotely (short of your phone itself being infected with malware). To get an MFA code from an authenticator app on your phone, the thief would have to:

• Be in physical possession of your unlocked phone, or
• Convince you to give them the code (which is also a potential failure point of email or text-based MFA). And again this is why we have to be super careful with these codes.

Authenticator apps take a bit of time to get used to, but once you’re used to using one, it’s quite easy. I have found Google Authenticator to be easy to use, but there are many other options as well (e.g., Microsoft Authenticator or Authy).

If you’re new to it, do not worry, regardless of which authenticator app you pick, there will be a ton of intro/walk-through videos on YouTube.

When setting up app-based multi-factor authentication, the website may give you the option to store some backup codes. These codes are to be used in case you lose your phone, so do store them somewhere. But of course make sure it’s somewhere safe (e.g., printing them out and storing in a safe or secure filing cabinet).

Removing Less-Secure MFA Methods

After activating multi-factor authentication by app, you may have to manually turn off multi-factor authentication via SMS/email. For many websites, the default behavior is that, if you already had some other method of MFA set up, after setting up MFA via authenticator app, that previous method will still remain as an option. And we usually don’t want that, because it leaves you vulnerable to exactly the types of attacks discussed above.