Two-factor authentication has a failure mode nobody talks about. Everyone tells you to turn it on. Almost nobody tells you what happens when the phone with all your codes ends up at the bottom of a lake.
I have watched smart people get locked out of their own lives because they did 2FA the fragile way. One device, one method, no plan. The account is secure right up until the second they cannot get into it either. So here is how I think about it: secure against an attacker, and recoverable by me. Both, not one.
First, kill SMS
Text-message codes feel like security. They are the weakest common option. A SIM swap, where someone convinces your carrier to move your number to their phone, hands an attacker every SMS code you have. It happens constantly, and the target is usually someone with crypto or a public profile.
Turn off SMS 2FA anywhere a real option exists. Where a service only offers SMS, treat that account as low-trust and do not let anything important hang off it.
The layers I actually run
The goal is more than one way in, so no single lost or stolen device ends the story.
A hardware key. A YubiKey is a physical thing an attacker cannot phish from across the internet. To log in, the key has to be there and get touched. This is the strongest factor there is. Buy two. One lives with me, one lives somewhere safe, and both are registered on every account that matters. If one is lost, the other still works.
An authenticator app. Time-based codes for the long tail of accounts that do not support a hardware key. The app lives on the phone, but the point below about backups is what makes it survivable.
Password managers, plural, on purpose. I do not pile everything into one vault. I run a mix and match the tool to the job. iCloud Keychain for everyday convenience and passkeys, since it is built into the OS and syncs across my Apple devices. 1Password and Bitwarden for the higher-security and shared cases, and to keep personal and work worlds separate instead of stacked behind one login. The useful question is not which password manager is best. It is which one fits this specific account, and how much it would hurt if that vault were the thing that got breached. Different blast radius, different tool.
Notice there is no SMS in that list.
A note on crypto: this is the setup for normal accounts, email, banking, socials, work. Crypto is a different and harder problem. Hardware wallets, seed phrases, and how to back those up without creating a brand new single point of failure deserve their own piece, and they will get one.
The part everyone skips: recovery
Security without a recovery plan is just a slower way to lose the account. Do this before you need it, because the day you need it is the worst day to figure it out.
Save the backup codes. Every serious service hands you a set of one-time recovery codes when you turn on 2FA. Most people click past them. Save them somewhere you will still have access to when your phone is gone, which by definition is not only on your phone.
Register more than one device. Two hardware keys. An authenticator on more than one device if the app supports encrypted sync. The rule is simple: losing any single device should be an annoyance, not a lockout.
Write down where everything lives. Which accounts use which key. Where the spare key is. Where the backup codes are. You are building a map that a calmer version of you can follow under stress.
Play out the two disasters
The phone is gone. Log in with the hardware key, or a passkey from another Apple device, or a backup code. Then, from a working device, de-register the lost phone and move the authenticator to the new one. The lost phone becomes a brick, not a breach.
The laptop is gone. The accounts do not live on the laptop, they live behind factors you can present from anywhere. New machine, sign in with the hardware key and Keychain, done. Nothing important should be recoverable only from one specific piece of hardware. If it is, that is the hole to fix first.
The principle underneath
This is the same rule I apply to any system worth building: no single point of failure. A setup that depends on one device is not secure, it is a coin flip you have not made yet. Add a second way in, write down the map, and the whole thing goes from fragile to boring. Boring is the goal.
Set it up once, on a calm afternoon, before anything is lost. Then forget about it, which is the entire point.
