Digital account security

01 — Two-factor authentication: why SMS codes and authenticator apps are not equivalent

Two-factor authentication adds a second requirement alongside a password to prove identity. The two most common methods, a code sent by text message or a code generated by an authenticator app, both satisfy that requirement, but they carry meaningfully different exposure to attack. NIST's Digital Identity Guidelines classify SMS-based codes as a restricted authenticator, the weakest category of second factor, and CISA's guidance goes further: "Do not use SMS as a second factor for authentication."

The reason comes down to how each method delivers the code. An SMS code travels through the carrier's network and arrives on whichever SIM card holds the phone number at that moment. That path has two documented vulnerabilities. SIM swapping occurs when an attacker convinces a carrier to transfer a phone number to a SIM they control, after which every SMS intended for the original holder arrives on the attacker's device instead. SS7 protocol exploits are separate attacks on the network infrastructure itself that can intercept messages in transit without any interaction with the carrier at all.

Authenticator apps, by contrast, generate codes locally on the device using a standard time-based algorithm. There is no code in transit, no phone number involved, and no carrier to social-engineer. The code exists on the device and expires in thirty seconds regardless of whether a network connection exists at all.

• Use an authenticator app wherever the option exists. Google Authenticator, Microsoft Authenticator, and Authy are the most common; all use the same underlying TOTP standard and are interchangeable for most purposes.
• SMS 2FA is still better than no second factor at all. CISA's guidance to avoid SMS applies to high-value accounts and organizational systems; for accounts where an authenticator app isn't offered, an SMS code is still a meaningful improvement over a password alone.
• Save the backup codes every service provides when 2FA is first set up. These one-time codes allow access to the account if the authenticator app or phone is lost, and they belong in the same secure location as other critical documents, not on the same phone that holds the app.
• Prioritize 2FA on the accounts that matter most first: the primary email account, any financial institution, and any account that stores sensitive personal or medical information.

02 — Cloud storage security: what the service protects and what it does not

Cloud storage services like Google Drive, iCloud, Dropbox, and OneDrive protect their own infrastructure from failure, maintain uptime, and secure their servers from external attack. What the shared-responsibility model, named and documented in CISA's ransomware guidance and NIST SP 500-292, makes clear is that users remain entirely responsible for their own data. The platform's obligations do not extend to recovering files a user deleted accidentally, restoring documents that ransomware encrypted via a synced folder, or protecting against account compromise.

The practical consequence is the scenario that surprises most people: a file deleted or corrupted through the user's own account, whether by the user or by malware running under their permissions, falls on the user to recover. Most major cloud platforms offer some version history or trash recovery, but these windows are limited, and they do not constitute a true backup in the event of account compromise or large-scale encryption by ransomware that synced its changes before the user noticed.

• Enable version history wherever the service offers it. Google Drive, Dropbox, and OneDrive all provide version tracking for documents; knowing the window length matters, since recovery options end when that window closes.
• Apply a separate, independent backup for anything irreplaceable. CISA's StopRansomware guide specifically recommends offline or cloud-to-cloud backups, meaning a copy stored in a different service or on a physical drive not continuously connected to the same account.
• Strong, unique passwords and 2FA protect cloud accounts themselves. Unauthorized account access is the most common path to cloud data loss for individual users, more than infrastructure failure, and a compromised account negates whatever security the platform provides at the infrastructure level.
• Understand what "sync" actually means. A sync relationship copies every change in both directions. If ransomware encrypts a local folder that syncs to the cloud, the cloud copy reflects the encrypted version, not the original. A true backup is a separate copy that doesn't follow the sync relationship.

03 — Email account recovery: why the primary email address is the master key to everything else

Most online accounts can only be recovered through the email address they were registered with. A password reset for a bank account, a streaming service, a cloud storage platform, or a social media account almost always works by sending a reset link to the account's email address. This makes the primary email account the single point of failure for an entire digital household: losing access to the email means losing the ability to reset every account attached to it.

CISA's guidance consistently identifies email accounts as a high-value target precisely because of this dependency structure. Compromising a person's email is not just about reading their messages; it is about using the reset-link path to take over every service connected to that address.

• Set a recovery email address and recovery phone number on the primary account. These are how the service sends a reset code if the account itself is locked out. A recovery path that doesn't exist cannot help in an emergency, and one that points to a disconnected number or an abandoned secondary account is just as useless.
• Enable 2FA on the primary email account before any other account, since it provides the password-reset path for everything else. Use an authenticator app rather than SMS for this account specifically, because the consequences of email compromise extend to every account tied to it.
• Know where the backup codes live. If the phone with the authenticator app is lost, backup codes are the only way to regain access without a lengthy account-recovery process through the provider's support team, which can take days and may not succeed if enough account information has been lost.
• Verify recovery information periodically, not just at initial setup. A recovery phone number from three years ago may be a number no longer in use, and a recovery email that was set once and never reviewed may belong to a service that has since been closed.