Two-factor authentication is one of the highest-value steps in any setup, and it is also where the difference between a weak and a strong implementation is largest. The same is true of the physical layer: the parts of security that are not software at all, and that are easy to overlook precisely because they are not on a screen.
Not all second factors are equal
The weakest common form of two-factor authentication is SMS, because text messages can be intercepted or redirected through attacks on the mobile network. An authenticator app is a clear improvement. But not every app is a good choice: rather than defaulting to Google Authenticator, an app such as Proton's, which sits inside a wider privacy-focused ecosystem, keeps your second factor out of the hands of the same company that may already hold much of your other data.
Hardware keys are the strongest link
The strongest form of two-factor authentication is a hardware key. A YubiKey, or any FIDO2 device, is a small physical object that proves your identity to a service in a way that phishing cannot defeat: even if you are tricked into entering your password on a fake site, the key will not authenticate against it. For the accounts that matter most, email, financial, and the ones that control everything else, a hardware key is the difference between a setup that can be phished and one that largely cannot. Buy two, and keep one as a backup.
The physical layer
Some of the most reliable protections are physical. A Faraday bag blocks all signals to and from a device placed inside it, which is useful for hardware that is not actively in use and does not need to be reachable. An NFC blocker in your wallet is a low-cost precaution: the real-world risk of someone skimming a modern contactless card is modest, but the protection costs almost nothing and does no harm. These are not exotic measures. They are simple, tangible steps that close small gaps.
The baseline assumption
Underneath all of this is a single working assumption: everything is tracked. That is not a reason for paranoia, it is a reason for structure. Where separation genuinely matters, a dedicated device is usually a cleaner solution than trying to isolate everything on one. And as with every other layer, hardware keys and separate devices are worth the most for the parts of your life that carry the most weight. Calibrate to that, and the rest follows.