When two-factor authentication was first introduced, it revolutionized device security and helped make identity theft much more difficult – at the slight cost of minor inconvenience added to logins.

But it’s not perfect, nor has it solved all of our hacking and data theft problems. Some recent news has provided more context for how hackers have been sidestepping two-factor authentication and eroding some of our trust in it.

Two-factor authentication adds an extra layer of security to the login process for devices and services. Previously, logins had a single factor for authentication — typically, a password, or a biometric login like a fingerprint scan or Face ID, occasionally with the addition of security questions. That provided some security, but it was far from perfect, especially with weak passwords or autofilled passwords (or if login databases are hacked and that info starts showing up on the dark web).

Two-factor authentication addresses these issues by adding a second factor, another thing a person hasto do to guarantee that it’s really them and they have authority to access. Typically, that means being sent a code via another channel, like getting a text message or email from the service, which you then have to input.

Some use time-sensitive codes (TOTP, Time-Based One Time Password), and some use unique codes associated with a specific device (HOTP, HMAC-based One Time Password). Certain commercial versions may even use additional physical keys that you need to have at hand.

The security feature has become so common, you’re probably used to seeing messages along the lines of, “We’ve sent you an email with a secure code to enter, please check your spam filter if you haven’t received it.” It’s most common for new devices, and while it takes a little time, it’s a huge jump in security compared to one-factor methods. But there are some flaws.

A report came out recently from cybersecurity company Sophos that detailed a surprising new way that hackers are skipping over two factor authentication: cookies. Bad actors have been “cookie stealing,” which gives them access to virtually any kind of browser, web service, email account, or even file.

How do these cybercriminals get these cookies? Well, Sophos notes that the Emotet botnet is one such cookie-stealing piece of malware that targets data in Google Chrome browsers. People can also purchase stolen cookies through underground marketplaces, which was made famous in the recent EA case where login details ended up on a marketplace called Genesis. The result was 780 gigabytes of stolen data that was used to try and extort the company.

While that’s a high-profile case, the underlying method is out there, and it shows that two-factor authentication is far from a silver bullet. Beyond just cookie stealing, there are a number of other issues that have been identified over the years:

Absolutely. In fact, you should go through your services and devices and enable two-factor authentication where it’s available. It offers significantly better security against problems like identity theft than a simple username and password.

Even SMS-based two-factor authentication is much better than none at all. Infact, the National Institute of Standards and Technology once recommended against using SMS in two-factor authentication, but then rolled that back the next year because, despite the flaws, it was still worth having.

When possible, choose an authentication method that’s not connected to text messages, and you’ll have a better form of security. Also, keep your passwords strong and use a password manager to generate them for logins if you can.

Moving away from SMS-based authentication is the big current project. It’s possible that two-factor authentication will transition to a handful of third-party apps like Duo, which remove many of the weaknesses associated with the process. And more high-risk fields will move into MFA, or multi-factor authentication, which adds a third requirement, like a fingerprint or additional security questions.

But the best way to remove issues with two-factor authentication is to introduce a physical, hardware-based aspect. Companies and government agencies are already starting to require that for certain access levels. In the near future, there’s a fair chance we’ll all have customized authentication cards in our wallets, ready to swipe at our devices when logging into services. It may sound weird now, but with the steep rise of cybersecurity attacks, it could end up being the most elegant solution.