Digital Safety8 min read
Your recovery options are the real password
Account takeovers rarely start with a guessed password. They start with a recovery email or phone number nobody had checked in years — and the change is designed not to be noticed.
Section
Digital Safety
Accounts, passwords, recovery and the first hour after something goes wrong.
2 articles
Digital Safety8 min read
SMS codes, authenticator apps, passkeys: which actually stops account takeover
All three are called two-factor authentication and they are not equivalent. Two of them can be phished in real time; one cannot, for a structural reason worth understanding.