| name | two-factor-setup |
| description | Complete guide for setting up and managing two-factor authentication including TOTP apps, FIDO2/WebAuthn hardware keys, recovery strategies, backup codes, and account protection prioritization.
Use when the user asks about two factor setup, related techniques, best practices, or needs guidance in this domain.
Do NOT use when the request is outside the scope of two factor setup or requires a different specialized skill.
|
| license | Apache-2.0 |
| metadata | {"author":"foundry-skills","version":"1.0.0","tags":"security checklist template cloud testing planning safety emergency-preparedness","category":"security","subcategory":"application-security","depends":"","disclaimer":"none","difficulty":"intermediate"} |
Two-Factor Authentication Setup
You are an expert in multi-factor authentication who guides users through selecting, configuring, and managing 2FA across all their accounts with robust recovery planning.
When to Use
Use this skill when:
- User asks about two factor setup techniques or best practices
- User needs guidance on two factor setup concepts
- User wants to implement or improve their approach to two factor setup
Do NOT use when:
- The request falls outside the scope of two factor setup
- User needs a different specialized skill for their specific situation
- The topic requires professional consultation beyond general guidance
2FA Methods Comparison
Security Hierarchy
STRONGEST ──────────────────────────────────── WEAKEST
FIDO2/WebAuthn > TOTP App > Push Notification > SMS/Voice
(Hardware key) (Authenticator) (App prompt) (Text message)
Phishing-resistant: YES NO NO NO
Requires internet: NO NO YES YES
SIM-swap proof: YES YES YES NO
Detailed Comparison
| Method | Security | Convenience | Offline | Phishing Proof | Cost |
|---|
| FIDO2 key | Excellent | Medium | Yes | Yes | $25-70 |
| TOTP app | Strong | Good | Yes | No | Free |
| Push notification | Good | Excellent | No | No | Free |
| SMS code | Weak | Good | No | No | Free |
| Email code | Weak | Fair | No | No | Free |
| Backup codes | Strong (one-time) | Fair | Yes | N/A | Free |
TOTP Authenticator Setup
Recommended Apps
| App | Platform | Cloud Backup | Export | Open Source |
|---|
| Aegis | Android | Encrypted backup | Yes | Yes |
| Raivo | iOS | iCloud encrypted | Yes | Yes |
| 2FAS | iOS, Android | Cloud + local | Yes | Yes |
| Authy | iOS, Android, Desktop | Encrypted cloud | No | No |
| Google Authenticator | iOS, Android | Google account | Yes | No |
| Microsoft Authenticator | iOS, Android | Cloud backup | No | No |
Setup Process
Step 1: Install authenticator app
- Download from official app store only
- Set up app lock (biometric or PIN)
- Enable encrypted backup if available
Step 2: Enable 2FA on an account
1. Go to account's Security Settings
2. Find "Two-Factor Authentication" or "2-Step Verification"
3. Select "Authenticator App" option
4. Scan QR code with your authenticator app
5. Enter the 6-digit code to verify
6. SAVE the backup/recovery codes immediately
Step 3: Save recovery information
- Screenshot the QR code (store encrypted, offline)
- Copy the secret key text (store in password vault)
- Save backup codes (print or store in vault)
- Test the code works before closing setup
TOTP Secret Key Backup
When setting up TOTP, the service shows a QR code.
That QR code encodes a URI like:
otpauth://totp/Service:user@email.com?secret=JBSWY3DPEHPK3PXP&issuer=Service
The "secret" value is what generates your codes.
Backup strategy:
1. Save the secret key text in your password vault
(as a custom field on the login entry)
2. If you lose your phone, you can re-add the TOTP
to a new device using this secret key
3. Some apps (Aegis, 2FAS) support encrypted export
of all TOTP entries - do this monthly
FIDO2 / WebAuthn Hardware Keys
Hardware Key Options
| Key | USB-A | USB-C | NFC | Lightning | Biometric | Price |
|---|
| YubiKey 5 NFC | Yes | No | Yes | No | No | ~$50 |
| YubiKey 5C NFC | No | Yes | Yes | No | No | ~$55 |
| YubiKey 5Ci | No | Yes | No | Yes | No | ~$75 |
| YubiKey Bio | Yes/C | Varies | No | No | Yes | ~$85 |
| Google Titan | Varies | Yes | Yes | No | No | ~$30 |
| Nitrokey FIDO2 | Yes | No | No | No | No | ~$30 |
| SoloKeys | Yes | Yes | No | No | No | ~$25 |
Setup Checklist
Step 1: Buy TWO keys (primary + backup)
- Different form factors if possible
(e.g., USB-C primary, USB-A + NFC backup)
Step 2: Register both keys on every account
1. Go to account Security Settings
2. Add Security Key (primary)
3. Touch the key when prompted
4. Name it: "YubiKey Primary - USB-C"
5. Add Security Key (backup)
6. Touch the backup key when prompted
7. Name it: "YubiKey Backup - USB-A NFC"
Step 3: Store the backup key securely
- Home safe, safety deposit box, or trusted person
- NOT in the same bag as your laptop
Step 4: Also keep TOTP as a fallback method
- In case both keys are unavailable
- Some services require a backup method anyway
Supported Services
High-value accounts that support FIDO2:
├── Google / Gmail
├── Microsoft / Outlook
├── Apple (iCloud) - with passkeys
├── GitHub
├── Facebook
├── Twitter/X
├── Dropbox
├── Cloudflare
├── AWS
├── 1Password
├── Bitwarden
├── Coinbase
├── Stripe
└── Many more (check dongleauth.com for full list)
Account Prioritization
Enable 2FA in This Order
CRITICAL (do these first):
├── 1. Email accounts (recovery path for everything)
├── 2. Password manager
├── 3. Financial accounts (banking, investment)
├── 4. Cloud storage (Google, Apple, Microsoft)
└── 5. Domain registrar (if you own domains)
HIGH PRIORITY:
├── 6. Social media (identity theft vector)
├── 7. Work/employer accounts
├── 8. Developer accounts (GitHub, AWS, npm)
├── 9. Crypto exchanges
└── 10. Phone/carrier account (SIM-swap protection)
MEDIUM PRIORITY:
├── 11. Shopping (Amazon, with saved payment)
├── 12. Streaming services
├── 13. Gaming accounts
└── 14. Forums and communities
For each account:
[ ] Enable strongest available 2FA method
[ ] Save backup codes
[ ] Register backup security key
[ ] Update password vault entry with 2FA status
Recovery Strategies
The Recovery Code System
When you enable 2FA, most services give you recovery codes.
Storage Strategy (3 locations):
1. Password vault - in a secure note or custom field
2. Printed copy - in a home safe or lockbox
3. Encrypted file - on an encrypted USB drive
Recovery Code Template:
┌────────────────────────────────────────┐
│ Service: Google (user@gmail.com) │
│ Date: 2025-01-15 │
│ Codes: │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ xxxx-xxxx-xxxx [ ] Used │
│ FIDO2 Keys Registered: │
│ Primary: YubiKey 5C NFC │
│ Backup: YubiKey 5 NFC │
│ TOTP App: Aegis (Android) │
└────────────────────────────────────────┘
Recovery Scenarios
| Scenario | Recovery Path |
|---|
| Lost phone (TOTP) | Restore from encrypted app backup; or use backup codes; or use FIDO2 key |
| Lost FIDO2 key | Use backup FIDO2 key; or use TOTP; or use backup codes |
| Lost phone AND keys | Use printed backup codes; then re-enroll new devices |
| New phone | Export TOTP from old phone; or restore from app cloud backup |
| skipped which app | Check password vault notes for which authenticator app |
| Used all backup codes | Generate new codes from account settings immediately |
| Account locked out | Contact service support with identity verification documents |
Phone Migration Checklist
When switching to a new phone:
BEFORE wiping old phone:
[ ] Export TOTP entries from authenticator app
[ ] Verify cloud backup of authenticator app is current
[ ] Test that FIDO2 NFC keys work with new phone
[ ] Ensure password vault app is on new phone and synced
On new phone:
[ ] Install authenticator app
[ ] Restore from encrypted backup OR re-import secrets
[ ] Test 2FA login on 3 critical accounts
[ ] Verify all entries are present (compare count)
After verification:
[ ] Factory reset old phone
[ ] Remove old phone from trusted devices on key accounts
Passkeys (Modern Authentication)
What Passkeys Are
Passkeys replace passwords entirely:
- Based on FIDO2/WebAuthn standard
- Private key stays on your device, never sent to server
- Phishing-proof by design (tied to specific domain)
- Biometric unlock (fingerprint, face) instead of typing
- Synced across devices via platform (Apple, Google, Microsoft)
or password manager (1Password, Bitwarden)
Passkey Setup
Step 1: Check if your password manager supports passkeys
- 1Password: Yes (recommended for cross-platform)
- Bitwarden: Yes
- Apple Keychain: Yes (Apple devices only)
- Google Password Manager: Yes (Chrome/Android)
Step 2: Create a passkey on a supported service
1. Go to account security settings
2. Find "Passkeys" or "Sign-in methods"
3. Click "Create passkey"
4. Choose where to store it (password manager or platform)
5. Authenticate with biometrics
6. Passkey is created and stored
Step 3: Keep a backup authentication method
- Passkeys are still new; keep password + TOTP as backup
- Register passkeys in your password manager for cross-device access
2FA Audit Checklist
Quarterly Review
Annual Review
Common Mistakes to Avoid
- SMS-only 2FA on critical accounts - Vulnerable to SIM-swapping attacks
- No backup method configured - Single point of failure
- Recovery codes not saved - Locked out permanently
- TOTP secrets not backed up - Phone loss = account loss
- Only one FIDO2 key registered - Key loss = account loss
- Same authenticator for personal and work - Separation of concerns
- Ignoring phone carrier PIN - Protect against SIM-swap
- Not testing recovery - Discover problems before an emergency
- Leaving old devices as trusted - Remove when no longer in use
- Sharing 2FA codes over text/email - Defeats the purpose of 2FA
Process
- Gather information. Ask the user clarifying questions to understand their specific situation, goals, and constraints
- Analyze context. Review the information provided and identify key factors relevant to two factor setup
- Develop recommendations. Apply domain expertise to create actionable guidance tailored to the user's needs
- Present structured output. Deliver findings in the output format below with clear next steps
- Address follow-ups. Answer additional questions and refine recommendations based on feedback
Output Format
## Two Factor Setup Analysis
### Assessment
[Key findings and observations]
### Recommendations
1. [Primary recommendation]
2. [Secondary recommendation]
3. [Additional suggestions]
### Action Items
- [ ] [First action step]
- [ ] [Second action step]
- [ ] [Follow-up task]
Edge Cases
- Incomplete information: Ask clarifying questions before proceeding with recommendations
- Conflicting requirements: Prioritize the most critical constraint and note trade-offs
- Out of scope requests: Redirect to appropriate specialized skill or professional resource
- Beginner vs advanced: Adjust depth and terminology based on user's experience level
Example
Input: "Help me with two factor setup for my current situation"
Output:
Based on your situation, here is a structured approach to two factor setup:
- Assessment: Evaluate your current state and identify key areas for improvement
- Strategy: Develop a targeted plan based on best practices
- Implementation: Execute the plan with specific, measurable steps
- Review: Monitor progress and adjust as needed
