Session 2: Authentication & Awareness

Authentication proves who you are, and there are only three kinds of proof. Something you know — a password or PIN. Something you have — a phone receiving a code, a hardware key, a card. Something you are — a fingerprint, a face. A system using one of these is single-factor; one requiring two different kinds is two-factor or multi-factor.

The distinction between the kinds matters more than the count. Two passwords are not two factors, because both are 'something you know' and an attacker who obtains one likely obtained both. A password plus a code from your phone is genuinely two factors, because compromising them requires two different kinds of attack. This is why the phrase 'two-step verification' sometimes means something weaker than real two-factor, and why you should check what you have actually enabled.

The reason two-factor works is straightforward: password theft is common and cheap, because passwords are reused, guessed, phished and bought in bulk after breaches. Getting physical access to your phone at the same moment is neither. That mismatch is the whole security gain, and it is why two-factor is the highest-value control available to an ordinary person.

SMS codes are the most common and the weakest of the real second factors, because they can be intercepted through SIM-swap fraud — where an attacker convinces your network to move your number to their SIM, which is a genuine and documented problem in Nigeria. They are still vastly better than nothing, and for most accounts they are worth enabling, but they are not the best option where a choice exists.

Authenticator apps — Google Authenticator, Microsoft Authenticator, Authy — generate codes on the device with no network involved, so there is nothing to intercept. They are strictly better than SMS and cost nothing. Passkeys and hardware keys are stronger again: a passkey uses public-key cryptography so there is no shared secret to phish, and a hardware key requires physical possession. These are the right choice for your most important accounts where supported.

Biometrics — fingerprint and face — are convenient and adequate for unlocking your own device, but understand what they are: a local unlock mechanism, not usually a real second factor for a remote service, and they cannot be changed if compromised. Your fingerprint is not a secret in the way a password is; you leave copies of it everywhere you touch.

Enabling two-factor is easy; the part people skip is recovery, and it is the part that causes the disasters. When you enable it, the service gives you backup or recovery codes — a list of one-time codes for use if you lose your phone. Save them somewhere that is not the phone: printed and kept safely, or stored in your password manager. Losing a phone with two-factor enabled and no recovery codes is a genuinely difficult problem, and it locks people out of email accounts they depend on.

Protect the recovery email and phone number on every important account with the same care as the account itself, because an attacker who can change them can reset everything. Check what those are set to on your main email account today — an old number you no longer control is a serious and common exposure.

And understand the ordering: your email account is the master key, because almost every other service can be reset through it. If you secure one account to a high standard, make it your primary email. Two-factor on it, a unique strong password, correct recovery details, and ideally a passkey. Everything else inherits that protection.

Here is the part most awareness training omits, and it matters. When you log into a website, the server gives your browser a session cookie — a token proving you are authenticated, so you do not have to type your password on every page. That cookie is what actually grants access, and stealing it grants access too, without ever needing your password or your second factor.

This is why a phishing page can succeed even against a two-factor account: the attacker proxies your login in real time, you enter both factors believing you are on the real site, and the attacker receives a valid session token. It is also why malware on a machine can steal active sessions from a browser, and why logging in on an untrusted or shared computer is genuinely risky in a way that 'being careful' does not fix.

The practical defences are concrete. Check the URL before entering credentials, every time, because a proxied phishing site has a different address however real it looks. Log out on shared machines rather than closing the tab. Do not log into important accounts on computers you do not control — a business centre machine, a friend's laptop. And treat a sudden request to re-authenticate as a reason to type the address yourself rather than follow the link.

Social engineering is manipulation rather than technology, and it works because it exploits traits that are useful in every other context: helpfulness, urgency, deference to authority, and reluctance to seem difficult. The common patterns are consistent. Urgency — 'your account will be closed within an hour' — which suppresses the checking you would otherwise do. Authority — a message apparently from a bank, a network operator, or your boss. Familiarity — a WhatsApp message from a number using a relative's name and photograph, asking for a small favour.

The specific asks are almost always one of three things: a one-time code, which is never legitimately requested by any real organisation and is the clearest signal of an attack; a payment, usually urgent and to an unfamiliar account; or credentials, via a link to a convincing fake login page. Learn those three and you will recognise the overwhelming majority of attempts, because the technique varies but the goal does not.

The defence is a small set of habits rather than vigilance, because vigilance fails when you are tired. Never share a one-time code with anyone, for any reason — no bank, network or delivery company will ever ask. Verify through a second channel: if a message claims to be from your bank, call the number on your card rather than the one in the message. Slow down deliberately when anything is urgent, because urgency is itself the strongest indicator that something is wrong. And check the sender and the link before acting, not after.