Section of the glossary
Eight terms about what actually protects an account. The password is not the main one: the recovery contacts and the type of second factor turn out to be.
English version for the United States.
Also: 2FA
A confirmation of sign-in additional to the password.
The methods are not equivalent. An SMS code is vulnerable to a SIM swap and is typed by the victim on a fake page. An authenticator app removes the first problem but not the second.
A hardware key closes both: it checks the address of the site itself, so a fake page cannot obtain a confirmation from it.
Also: recovery phrase
The sequence of words from which a cryptocurrency wallet is restored.
The phrase is a compact form of the private key, which means it is the asset itself rather than a password to it. Whoever reads it controls the funds; whoever loses it loses the funds permanently.
Two consequences follow: it is never entered on a page that asks for it, and it is never kept anywhere that synchronises, such as notes, a message to yourself or a cloud folder.
Also: vault
Software that stores passwords and fills them in only on a matching address.
It is usually valued for long passwords, but the more useful property is different: the manager will not fill a password on a fake site, because the address does not match. That works without your participation.
The second property matters for a team: access is granted and revoked in one place, and revocation actually takes effect, unlike a password passed through a chat.
Also: recovery codes
One-time codes for signing in when the second factor is unavailable.
They work without a network and without a phone, which covers the most common situation: losing the phone together with the SIM card.
The point is lost if the codes live in that same phone or in the account they unlock. They are printed and kept separately.
Also: SIM substitution
Reissuing a SIM card to an attacker in order to intercept codes and calls.
It is carried out through the mobile operator rather than through your phone, so no trace remains on the device. The first sign is the phone suddenly losing service for no reason.
The direct consequence: any account whose recovery runs through a number is protected exactly as well as the operator's reissue procedure.
Also: signed-in device
An already open access to an account that does not require the password again.
Changing a password does not always end open sessions, which is why «sign out everywhere» is pressed separately after an incident. Without it the intruder stays inside with the new password.
The list of sessions and devices is useful outside an incident too: an unfamiliar line means access is open right now.
Also: recovery email and number
The email and the number to which account recovery is sent.
This is the most underrated setting: whoever controls them controls the account regardless of the password and the second factor.
The first thing an intruder changes is exactly this, which is why a check after an incident starts here rather than with the password.
Also: security key
A physical device that confirms sign-in under a standard tied to the address of the site.
The key does not produce a code that can be read out or typed in the wrong place. It answers only the address it was registered for, so a fake page is left with nothing.
What it does not do: it will confirm any action the owner confirms. It does not protect against a malicious permission approved deliberately.
| Method | Protects against | Does not protect against |
|---|---|---|
| SMS code | Password guessing | SIM swap, a fake page |
| Authenticator app | SIM swap | Entering the code on a fake page |
| Hardware key | A fake page | A malicious action approved deliberately |
| Backup codes | Losing the phone | Being stored next to the phone |