8 min read
Amazon and eBay 2FA: the setting buried too deep
Amazon's two-step verification setting is famously buried. Where it actually lives, why the authenticator app beats SMS, and how eBay's version compares.
Read the postBlog
Two-factor auth,explained plainly.
No fluff and no fear marketing. Standards, mechanics, and practical decisions, written by the people who build the thing.
9 min readGitHub 2FA in 2026: the mandate, passkeys, and what it protects
GitHub made 2FA mandatory for maintainers of active code. What the mandate covers, passkeys versus authenticator apps, sudo mode, tokens, and the GitLab and npm siblings.
Read the post
9 min read2FA vs MFA vs two-step: what the words actually mean
2FA vs MFA: every real 2FA is MFA, but two-step can be one factor asked twice. Plain definitions, the vendor naming mess, and the rule that decides what counts.
Read the post
9 min readSIM swapping: how your phone number becomes the weak link
A SIM swap moves your number onto the attacker's SIM, so every SMS code lands on their phone. What breaks, what a port-out PIN does, and what to fix first.
Read the post
9 min readLost your phone with the authenticator on it? The calm playbook
Lost the phone with your authenticator on it? The calm playbook: triage your remaining factors, spend backup codes in the right order, then prepare so it never happens again.
Read the post
9 min readRecovery codes: the spare key you only get to see once
What 2FA backup codes actually are, why you only see them once, where to keep them, and why a second registered factor still beats a set of single-use spares.
Read the post
9 min readWhatsApp, Telegram, and Signal: the second factors nobody talks about
WhatsApp, Telegram, and Signal skip TOTP entirely — their second factor is a PIN or password guarding phone-number login. What each protects against, and what it can't.
Read the post
9 min read2FA for Instagram, Facebook, TikTok, and X (2026)
Where 2FA actually lives on Instagram, Facebook, TikTok, X, Reddit, and LinkedIn in 2026 — real menu paths, which methods are worth using, and surviving Meta's recovery queue.
Read the post
9 min readHow to enable 2FA on Discord (2026)
Discord uses standard TOTP, so any authenticator app works. Here is how to enable 2FA, what backup codes actually do, and the QR login scam to watch for.
Read the post
9 min readSteam Guard in 2026: email codes, the mobile authenticator, and trade holds
Steam Guard is not standard TOTP — it is Valve's own system. A plain-language guide to the mobile authenticator, trade holds, the R-code, and the scams that target traders.
Read the post
Showing 1–10 of 55 posts