Lion Cipher Lab
Set up strong two-factor authentication on your most important accounts
- Foundations
- Beginner
- ~30-45 min
- Free · no account required
Why it matters
A password alone is a single point of failure: if it leaks in a breach, is guessed, or is phished, whoever has it is you. Two-factor authentication adds a second, independent check so a stolen password by itself is no longer enough to get in -- and that one change shuts out the large majority of everyday account takeovers. But not every second factor is equally strong: a code texted to your phone is far better than nothing yet can be stolen without touching your device, while a passkey or hardware security key is built to resist exactly the phishing and interception that beat weaker methods.…
What you'll learn
- two-factor authentication (2FA/MFA)
- the 2FA strength hierarchy (SMS vs authenticator app vs passkey/security key)
- authenticator apps and TOTP codes
- passkeys
- hardware security keys
- recognizing SIM-swap risk in SMS codes
- saving and storing backup recovery codes
- prioritizing which accounts to protect first
Steps in this lab
- What 2FA is, and the plan
- The 2FA hierarchy, weakest to strongest
- Why SMS is the weak link: SIM swapping
- Protect your email FIRST -- app or passkey
- Save your backup and recovery codes -- do not skip this
- Add a passkey or hardware key to your highest-value accounts
- Work outward -- and remove SMS as the only method
- What you just did -- and how to keep it