Is two-factor authentication worth using?

Factor choice matters. Passkeys and hardware security keys provide the strongest phishing resistance; an authenticator app is a broadly supported fallback; SMS is weaker because of number takeover and SIM-swap risk, but remains better than a password alone. Save recovery codes offline, register a second factor before replacing a phone, and test the recovery path while access still works. Treat an unexpected approval prompt as an attack—deny it and review the account rather than approving to stop the notifications.