Two factor stops phishing
Two factor login protects me from phishing
What it does defeat
A leaked or reused password, which is the most common way accounts are lost across this whole space. Somebody trying a credential pair harvested from an unrelated breach hits the challenge and stops. That is a real and valuable protection and nothing here argues against turning it on immediately.
Why it does not defeat phishing
A clone collects the password and the challenge response in the same moment and replays both immediately. The second factor is a code with a short life, and a live attacker does not need it to live long. They need it once, right now, and you have just given it to them.
Two factor was designed against an attacker who obtains credentials and uses them later. Phishing is an attacker who obtains them and uses them within seconds. The protection and the attack are aimed at different points in time.
What sits upstream
Arriving at the genuine site in the first place, which is the signature check and nothing else. That is why the ordering in this register keeps putting verification ahead of account settings. Two factor is the second line and a good one. The first line is knowing that the page asking for your credentials is real, and it takes about as long as the login itself.
The part people regret
Recovery material. Save it at setup, before closing the page, somewhere separate from the password. Recovery without it is limited and sometimes impossible, and the position nobody wants is holding a balance behind a challenge they can no longer answer.
- Keep it apart from the password. Both in one place is one factor wearing a costume.
- Not only on one device. Devices get lost and replaced, usually at the worst moment.
- Not in a screenshot. Photo libraries sync, back up, and get indexed by software that reads text in images.
- Test it once from a second place before you need it.
Two failures that look like an attack
Codes suddenly rejected is usually clock drift, common on machines that have been off a while or run isolated. A code accepted then rejected is usually a slow circuit pushing you past the window. Both read as something sinister and are neither, and both are worth ruling out before concluding anything.