What are the differences between using an authenticator app and a security key for two‑factor authentication?
Short answer
An authenticator app creates time‑based one‑time passwords on your phone, while a security key is a separate hardware token that performs a cryptographic challenge‑response without exposing a secret. The key requires physical presence and resists phishing, whereas the app relies on the device’s security and manual code entry.
The details
Authenticator apps store a secret seed and produce a one‑time password (OTP) that you enter manually. They work on any smartphone and require the device to be unlocked. The secret can be extracted if the phone is compromised, so they rely on the device’s security and the user’s vigilance.
Security keys implement FIDO standards and perform a cryptographic challenge‑response without exposing a secret. The key must be physically present and is immune to phishing because it only signs authentication requests from the legitimate site. Loss of the key requires a backup method, but the key itself cannot be cloned.
What to do
- Enable MFA in the account settings.
- Choose either an authenticator app or a FIDO security key.
- Follow the on‑screen QR code or USB/NFC pairing instructions.
- Store a backup method (e.g., another key or recovery codes).
- Test login to verify the factor works.
Terms explained
- Backup (3-2-1 rule)
- A backup is a separate copy of data that can be restored after deletion, failure or attack. The 3-2-1 rule means three copies, on two types of storage, with one off-site.
- Passkey
- A passkey is a phishing-resistant sign-in credential based on public-key cryptography, stored on a device or in a password manager and unlocked with a biometric or device PIN.
- Phishing
- Phishing is a fraudulent message, usually email, that impersonates a trusted sender to trick people into revealing credentials, paying money or running malware.