Glossary
What is two-factor authentication (2FA)?
Two-factor authentication (2FA) requires a second proof of identity after a password: a code from an authenticator app, a text message, a hardware key or a passkey prompt. It blocks most account takeovers. For AI agents, 2FA prompts are a stop point where the account owner must step in.
Factor types
| Factor | Strength |
|---|---|
| SMS code | Weakest (SIM swap risk) |
| Email code | Depends on email security |
| Authenticator app (TOTP) | Strong |
| Push approval | Strong, watch for fatigue attacks |
| Hardware key / passkey | Strongest, phishing-resistant |
For founders
Launching creates many accounts: launch platforms, directories, review sites, communities. Use a password manager, enable 2FA where offered (especially on accounts tied to payments or your main email), and keep recovery codes safe.
For agents
An agent working in your browser should never handle your 2FA codes from plain text. When a site asks for a second factor, the agent pauses; you approve on your device; the agent continues.
Example
An agent signing in to a review site hits a 2FA prompt, pauses and notifies the founder. She approves the push on her phone and the agent finishes updating the listing.
FAQ
Is 2FA the same as MFA?
2FA uses two factors; MFA means two or more. Often used interchangeably.
Is SMS 2FA safe?
Better than none, weaker than apps or keys.
Can AI agents use 2FA?
They shouldn't hold your second factor; you complete it.
What are recovery codes?
One-time codes given when you set up 2FA, used to get in if you lose your second factor. Store them safely.