--- title: Two-Step Verification: The One Setting Worth Turning On url: https://hdiss.net/guides/two-step-verification/ business: High Desert Internet Services (HDISS) phone: 775-575-9593, 775-391-5660 email: info@hdiss.net mailing_address: Home base: 200 S Virginia St, Suite 760, Reno NV 89501 (dispatch office, not a walk-in store). Mail: Billing Dept., PO Box 11353, Reno NV 89510 hours: Office open 9:00 AM to 5:00 PM, seven days a week. Network watched around the clock. type: Fixed wireless internet service provider (homes and small businesses), web hosting, customer email, domain registration service_area: Northern Nevada - Washoe, Lyon, Storey, Churchill and Douglas counties and Carson City; availability is checked address by address (line of sight to a tower) plans: Bronze $50/mo up to 500 Mbps down, up to 200 Mbps up; Silver $75/mo up to 800 down, up to 200 up; Gold $99/mo up to 1 Gig down, up to 200 up; ask about the up to 1 Gig / 1 Gig ultra-low-latency service no_online_purchase: true (check your address or call; existing customers pay at https://www2.fernley.net/hdiss/onlinepay/paymentform.cfm) since: 2002 --- - [Home](https://hdiss.net/) - [Guides](https://hdiss.net/guides/) - Two-step verification: the one setting worth turning on # Two-Step Verification: The One Setting Worth Turning On Two-step verification asks for something besides your password, such as a code from an app. CISA says it makes you significantly safer: even if someone steals your password, they cannot get past the second step. Turn it on for email first. Sagebrush prairie in the high desert. Stock photo: Adobe Stock. [Photo credits](https://hdiss.net/photo-credits/) On this page - [What is it?](#what-is-it) - [Which kind should you choose?](#which-kind-should-you-choose) - [How do you turn it on?](#how-do-you-turn-it-on) - [Which accounts first?](#which-accounts-first) - [What can go wrong?](#what-can-go-wrong) If you do one thing after reading our safety guides, do this. A password can be guessed, reused or stolen in a data breach. A second step stops most of those problems from turning into a taken-over account. This guide explains the choices and the steps, with CISA's description of how it works. ## Takeaways - CISA: MFA can make us significantly safer; even if an unauthorized user steals your password, they will not be able to meet the second step. - Methods CISA lists: a code by text or email, an authenticator app (new code every 30 seconds), or biometrics. - CISA points to phishing-resistant MFA, based on FIDO, as the strongest. - The FTC and ICANN both advise turning it on, for sensitive accounts and for your domain registrar. ## What is it? Multifactor authentication, or MFA, is also called two-factor or two-step verification. Instead of a password alone, the login asks for another proof: something you know (the password), something you have (your phone or a key) or something you are (a fingerprint or face). CISA's page explains that MFA provides extra security by confirming your identity when you log in, “like entering a code texted to a phone or one generated by an authenticator app,” and that even if an unauthorized user steals your password, they will not be able to meet the second step. It is a plain improvement. A thief who buys your password in a breach still cannot open the account. ## Which kind should you choose? CISA's list of methods: receiving a numeric code by text or email; using an authenticator app, a phone app that generates a new code every 30 seconds; and biometrics, such as facial recognition or a fingerprint. For the strongest protection, CISA points to phishing-resistant MFA, based on FIDO standards. A practical order: phishing-resistant MFA where a service offers it, an authenticator app next, and a text code if that is all there is. A text code is better than nothing. ## How do you turn it on? CISA's steps: go to Settings, look under your account profile for Account Settings, Profile, Preferences, Privacy or similar, and open the security settings, which may be labeled Security or Password and Security. Look for and turn on MFA, which may be called two-factor authentication, two-step authentication or similar. Then confirm which method to use from the options offered. Allow ten minutes for your first account. Save the backup codes the service shows you. Print them or store them in your password manager, because they are your way back in if you lose the phone. ## Which accounts first? Start with the accounts that unlock the others: your email, since password resets go there; your bank and card accounts; your phone carrier account; your password manager; and your Apple, Google or Microsoft account. Then social media, shopping and anything with stored cards. If you run a business, the FTC says to require multi-factor authentication to protect sensitive information. If you own a domain name, ICANN advises enabling multi-factor authentication at your registrar. See [fake domain renewal notices](https://hdiss.net/guides/fake-domain-renewal-notices/). Pair it with a good password manager; see [passwords and password managers](https://hdiss.net/guides/passwords-and-password-managers/). ## What can go wrong? The common trouble is a lost or replaced phone. Before you retire a phone, move your authenticator app and test the codes on the new one. Keep the backup codes. Beware of a message that asks you to read back a code you received: legitimate services do not call you to ask for it. That is a scam, and it is how some accounts are taken even with two-step verification; see [what to do after a phishing click](https://hdiss.net/guides/clicked-a-phishing-link-what-now/). Send your address through the check form before you settle on a provider. A person checks the path from the nearest tower and calls with the answer. Call 775-575-9593, 9 to 5 every day, if you want to talk it through. ### Sources - [cisa.gov/secure-our-world/turn-mfa](https://www.cisa.gov/secure-our-world/turn-mfa) (CISA, Turn on MFA, read 10/15/26) - [consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know](https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know) (FTC, read 10/15/26) - [ftc.gov/business-guidance/small-businesses/cybersecurity](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity) (FTC, Cybersecurity for Small Business, read 10/15/26) - [icann.org/en/blogs/details/do-you-have-a-domain-name-heres-what-you-need-to-know-30-4-2020](https://www.icann.org/en/blogs/details/do-you-have-a-domain-name-heres-what-you-need-to-know-30-4-2020-en) (ICANN, April 30, 2020, read 10/15/26) ### Talk to a person - Call [775-575-9593](tel:7755759593) [775-391-5660](tel:7753915660) Open 9-5 every day - Email [info@hdiss.net](mailto:info@hdiss.net) [Check my address](https://hdiss.net/check-availability/#check) Local since 2002 Fixed wireless from towers in Northern Nevada. Three plans, no contracts, local support, 4.8 on Google from 36 reviews. [About High Desert](https://hdiss.net/about/) ### Keep reading - [Passwords and password managers in plain words](https://hdiss.net/guides/passwords-and-password-managers/) - [You clicked a phishing link: what to do next](https://hdiss.net/guides/clicked-a-phishing-link-what-now/) - [Online scams that target older adults](https://hdiss.net/guides/scams-that-target-older-adults/) - [Fake domain renewal notices and how to spot them](https://hdiss.net/guides/fake-domain-renewal-notices/) - [Securing a small business network and card payments](https://hdiss.net/guides/secure-a-small-business-network/) ## More on online safety - [Tech support scam calls and pop-ups: how to spot them](https://hdiss.net/guides/tech-support-scam-calls/): Real security warnings do not ask you to phone a number. If a pop-up, call or text says your computer is infected and tells you to call or let someone connect, stop: do not call, do not click, do not pay, and do not give - [Online scams that target older adults](https://hdiss.net/guides/scams-that-target-older-adults/): People 60 and older filed 201,266 complaints with the FBI's Internet Crime Complaint Center in 2025, with $7.748 billion in reported losses. Investment, tech support and romance scams carried the largest losses, and - [Passwords and password managers in plain words](https://hdiss.net/guides/passwords-and-password-managers/): Make passwords long, unique and unpredictable, and let a password manager remember them. NIST's current guidance says length matters more than rules about symbols, and says organizations should not force regular cha ## Questions people ask ### Does it make logging in slower? A little, at first. Many services ask for the second step only on a new device or after a set time. ### Is a code by text safe enough? It is much better than a password alone. An app or a passkey is stronger.