Two-Factor Authentication — 2FA
Qué es Two-Factor Authentication?
Esta entrada está disponible actualmente solo en inglés.
Two-factor authentication (2FA) is a security practice where a user proves their identity with two independent factors — typically a password or PIN (something they know) plus a one-time code delivered by SMS, generated in an authenticator app, or confirmed by a phone call (something they have). A second factor blocks the stolen-password problem: even if an attacker knows the password, they can't act on it without also holding the phone or device.
More detail
2FA codes travel over three common channels: SMS (the short code arrives as a text message), time-based one-time passwords (TOTP, generated locally by an authenticator app), and flash calls (a missed call where the incoming number itself is the verification). Each has different UX and fraud-resistance trade-offs — SMS reaches every phone, TOTP never leaves the device, and flash calls verify phone possession without a code to copy.
The strongest 2FA flows keep the second channel distinct from the user's main session: a code that shows up in the same app the user is authenticating into (or that the attacker has already compromised) defeats the point. Shortening validity windows (typically 5-10 minutes) and hashing codes before storage tighten the window attackers have to reuse an intercepted code.
Beyond the login flow, 2FA is also how services verify orders, reset passwords, and confirm account changes — any moment where a mistaken identity would cost the user or the provider money or data.
Preguntas frecuentes
- What is the difference between 2FA and multi-factor authentication (MFA)?
- MFA is the umbrella term for any flow that requires more than one factor; 2FA is the specific case that uses exactly two. In practice the terms are used interchangeably — the standard 2FA pattern (password + one-time code) is the most common MFA deployment.
- Is SMS still a good second factor?
- SMS 2FA still beats no second factor at all, and it reaches every phone. Its known weaknesses are SIM-swap and SS7 interception, so high-value accounts increasingly layer TOTP or a push-notification factor on top, but for most consumer flows SMS remains the lowest-friction second factor users will actually complete.
- How does 2FA pair with Orbit's verification features?
- Orbit's OTP, TOTP, and flash-call verification terms each detail one 2FA channel — 2FA is the umbrella strategy that weaves them together. A typical 2FA flow on Orbit sends an SMS or flash call on the user's device, then validates the submitted code against a stored, hashed value.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.