Two-factor authentication: the family setup
One change that blocks nearly every account-theft attack. Here’s how.
Why 2FA is the single biggest defense
Passwords get leaked, phished, and guessed. Two-factor authentication (2FA, sometimes called 2-step verification or MFA) adds a second check at login — a one-time code or a physical key. Even if an attacker has your kid’s password, they can’t log in without the second factor.
The hierarchy of 2FA methods
- Hardware security key (FIDO2, e.g., YubiKey) — strongest. Phishing-resistant. ~$30 per key.
- Authenticator app (TOTP, e.g., Google Authenticator, Authy, 1Password) — excellent. Free. Works offline.
- Push notification to a trusted device — good. Phishing-resistant if the device itself is secure.
- SMS code — last resort. Vulnerable to SIM-swap attacks. Better than nothing but upgrade to app-based when offered.
- Email code — weakest (if email is also compromised).
Which accounts to turn on first
- Email (Gmail, Outlook, iCloud) — the master key. If email has 2FA, most other accounts can be recovered.
- Apple ID / Google account / Microsoft account — tied to all your devices.
- Banking and financial.
- Password manager master account.
- Social media (Instagram, Snap, TikTok, Discord).
- Gaming (Roblox, Epic, Steam).
- Amazon, Netflix, Disney+ (surprisingly common targets).
Setup walkthrough (typical flow)
- Go to account security settings on the service.
- Enable two-step / two-factor verification.
- Choose authenticator app; scan the QR code in your authenticator.
- Enter the code shown in the app to confirm.
- Save the backup / recovery codes in your password manager. If you lose your phone, these codes get you back in.
- Test by signing out and back in.
The recovery-code problem
The #1 failure mode of 2FA: losing access to the authenticator with no backup codes. Ways to prevent:
- Save backup codes in your password manager.
- Use an authenticator with cloud backup (Authy, 1Password, Bitwarden).
- Register a second 2FA method on each account (e.g., both an authenticator app and a hardware key).
Teaching kids
2FA is a lifelong habit. Set it up together the first time so the kid understands what it is. Consider: their Roblox account is probably more valuable to them than their email — start there.
Common questions
Why does two-factor authentication matter so much?
Because it defeats nearly every account-theft attack. Passwords get leaked, phished and guessed; a second factor means that even someone holding your child’s password cannot log in. It is the single highest-value security change available.
Which type of 2FA is best?
In order: a hardware security key such as a YubiKey is strongest and phishing-resistant at around $30; an authenticator app using TOTP is excellent, free and works offline; push notifications to a trusted device are good; SMS codes are a last resort because SIM-swap attacks defeat them; and email codes are weakest of all.
Which accounts should we secure first?
Email first — it is the master key, because most other accounts can be recovered through it. Then the Apple, Google or Microsoft account tied to the devices, then banking, then the password manager, then social media, then gaming accounts such as Roblox, Epic and Steam.
What is the most common way 2FA goes wrong?
Losing access to the authenticator with no backup codes saved. Prevent it three ways: save the recovery codes in your password manager, use an authenticator with cloud backup such as Authy, 1Password or Bitwarden, and register a second method on each account.
How do I get a child to care about this?
Start with the account they value most, which is usually Roblox rather than email. Set it up together the first time so they understand what it is doing — 2FA is a lifelong habit, and it lands better as a skill than as a rule.