A Reading from The Book of Internet Security

Two-factor authentication (also known as 2FA) is a type (subset) of multi-factor authentication. It is a method of confirming a user's claimed identity by utilizing a combination of two different factors: 1) something they know, and 2) something they have.

-- Wikipedia

I have two factor authentication set up via Google Authenticator (Microsoft Authenticator works the same way) for:

• Amazon
• BitBucket
• Facebook
• GitHub
• Google
• LastPass
• TunnelBroker.net
• Microsoft, and
• The Raspberry Pi downstairs sitting by my home Internet router.

I've also got two factor set via text message/email for Vanguard, Twitter, and others. These methods are not as secure as Google/Microsoft Authenticator (your phone number and/or email can be hijacked), but it's better than thinking no one will try to hack an account.

Actually, you or I personally won't be hacked, unless you ticked off the Russians or the Chinese -- our accounts are just a entry on a list, and someone is hacking the entire list. Your accounts are or will be a malware statistic. Mine won't, because I've got two factor on them.

So go through all your supported accounts (all, even the ones you never use) and put two factor on them today. Don't know where to start? Try here. As to when do it, the best answer is yesterday. So do it now.

p.s. Some of the sites I listed also support YubiKey -- it's also secure, and I use that when possible. But the point is, I do something for two factor whenever possible.