Unique credentials
A complete answer to one adversary and a partial answer to two more, for about ten minutes of setup.
Uniqueness, not strength
Password strength protects against guessing, which is not the attack. The attack is a credential pair leaked from an unrelated service being tried everywhere by something automated. A long complicated password reused somewhere that leaked it is exactly as useless as a short simple one, and the confidence it produces makes it worse.
What two factor adds
| Attack | Stopped? |
|---|---|
| A leaked password tried later | Yes, completely. Exactly what it was designed against. |
| A live clone page | No. It collects password and code together and replays both while the code is valid. |
| A compromised machine | No. Nothing on the account side helps. |
So two factor is worth turning on immediately and it is the second line. The first is arriving at the genuine site, which is the check and nothing else.
The part people regret
- Save the recovery material at setup, before closing the page. Recovery without it is limited and often impossible.
- Keep it separate from the password. Both in one place is one factor wearing a costume.
- Do not keep the only copy on one device. Devices get lost and replaced, usually at the worst moment.
- Not in a screenshot. Photo libraries sync, back up, and get indexed by software that reads text in images.
- Test once that you can actually produce it from a second place.
Two failures that look like an attack
Codes suddenly rejected is usually clock drift, common on machines that have been off a while or run isolated. A code accepted and then rejected is usually a slow circuit pushing you past the window. Both read as something sinister, both are neither, and both are worth ruling out before concluding anything.