Two-factor authentication (2FA) is what happens when you enter your username and password, only to be hit with the dreaded prompt: “Please enter the code sent to [your email address].” In theory, it’s an extra layer of security. Even if someone has your credentials, they still need access to your email or phone. In practice, though, 2FA is more trouble for the user than for the hacker.