Passwords on their own aren’t as infallible as we need them to be. Cyber attackers have the power to test billions of passwords combinations in a second.90 percent of employees password can be cracked in few hours
What’s even worse, 65% of people use the same password everywhere. That’s pretty much similar to having only one key for your house and your car.
Answers to security questions are also easy to find out, especially now that we are willingly sharing all the details about our lives on social networks and blogs. Anyone that interacts with us on a daily basis can find out the answers to common security questions, such as the graduation year, the city that you grew up in or our first pet’s name.
Even if you don’t give these out in your Facebook profile, some can be found through public records, available for anyone who cares to look. Others can be cracked simply by entering common names.
This is where two-factor authentication comes in handy. It will offer you an extra layer of protection, besides passwords. It’s hard for cyber criminals to get the second authentication factor, they would have to be much closer to you. This drastically reduces their chances to succeed.
Two-factor authentication (2FA), sometimes referred to as two-step verification or dual-factor authentication, is a security process in which users provide two different authentication factor to verify themselves. This process is done to better protect both the user’s credentials and the resources the user can access. Two-factor authentication provides a higher level of security than authentication methods that depend on single-factor authentication (SFA), in which the user provides only one factor — typically, a password or passcode. Two-factor authentication methods rely on a user providing a password, as well as a second factor, usually either a security token or a biometric factor, such as a fingerprint or facial scan.
Two-factor authentication adds an additional layer of security to the authentication process by making it harder for attackers to gain access to a person’s devices or online accounts because knowing the victim’s password alone is not enough to pass the authentication check. Two-factor authentication has long been used to control access to sensitive systems and data, and online service providers are increasingly using 2FA to protect their users’ credentials from being used by hackers who have stolen a password database or used phishing campaigns to obtain user passwords.
Two–factor authentication is an extra layer of security for your Apple ID designed to ensure that you’re the only person who can access your account, even if someone knows your password
With 2–factor authentication, an extra layer of security is added to your account to prevent someone from logging in, even if they have your password. This extra security measure requires you to verify your identity using a randomized 6-digit code we’ll send you each time you attempt to log in.
What does two factor authentication do?
Two–factor authentication (2FA) is a security system that requires two distinct forms of identification in order to access something. Two–factor authentication can be used to strengthen the security of an online account, a smartphone, or even a door.
TYPES OF TWO FACTOR AUTHENTICATION
There are four main types of 2FA in common use by consumer websites and it’s useful to know the differences. Some sites offer only one option; other sites offer a few different options. We recommend checking twofactorauth.org to find out which sites support 2FA and how, and turning on 2FA for as many of your online accounts as possible. For more visual learners, this infographic from Access Now offers additional information
Finally, the extra layer of protection from 2FA doesn’t mean you should use a weak password. Always make unique strong passwords for each of your accounts, and then put 2FA on top of those for even better log-in security.
SMS 2FA
When you enable a site’s SMS 2FA option, you’ll often be asked to provide a phone number. Next time you log in with your username and password, you’ll also be asked to enter a short code (typically 5-6 digits) that gets texted to your phone. This is a very popular option for sites to implement, since many people have an SMS-capable phone number and it doesn’t require installing an app. It provides a significant step up in account security relative to just a username and password.ADVERTISEMENT
There are some disadvantages, however. Some people may not be comfortable giving their phone number—a piece of potentially identifying information—to a given website or platform. Even worse, some websites, once they have your phone number for 2FA purposes, will use it for other purposes, like targeted advertising, conversion tracking, and password resets. Allowing password resets based on a phone number provided for 2FA is an especially egregious problem, because it means attackers using phone number takeovers could get access to your account without even knowing your password
Further, you can’t log in with SMS 2FA if your phone is dead or can’t connect to a mobile network. This can especially be a problem when travelling abroad. Also, it’s often possible for an attacker to trick your phone company into assigning your phone number to a different SIM card, allowing them to receive your 2FA codes. Flaws in the telephony protocol can allow the same thing. Note that both of these attacks only reduce the security of your account to the security of your password
Authenticator App / TOTP 2FA
Another phone-based option for 2FA is to use an application that generates codes locally based on a secret key. Google Authenticator is a very popular application for this; FreeOTP is a free software alternative. The underlying technology for this style of 2FA is called Time-Based One Time Password (TOTP), and is part of the Open Authentication (OATH) architecture (not to be confused with OAuth, the technology behind “Log in with Facebook” and “Log in with Twitter” buttons).
If a site offers this style of 2FA, it will show you a QR code containing the secret key. You can scan that QR code into your application. If you have multiple phones you can scan it multiple times; you can also save the image to a safe place or print it out if you need a backup. Once you’ve scanned such a QR code, your application will produce a new 6-digit code every 30 seconds. Similar to SMS 2FA, you’ll have to enter one of these codes in addition to your username and password in order to log in.
This style of 2FA improves on SMS 2FA because you can use it even when your phone is not connected to a mobile network, and because the secret key is stored physically on your phone. If someone redirects your phone number to their own phone, they still won’t be able to get your 2FA codes. It also has some disadvantages: If your phone dies or gets stolen, and you don’t have printed backup codes or a saved copy of the original QR code, you can lose access to your account. For this reason, many sites will encourage you to enable SMS 2FA as a backup. Also, if you log in frequently on different computers, it can be inconvenient to unlock your phone, open an app, and type in the code each time.
Push-based 2FA
Some systems, like Duo Push and Apple’s Trusted Devices method, can send a prompt to one of your devices during login. This prompt will indicate that someone (possibly you) is trying to log in, and an estimated location for the login attempt. You can then approve or deny the attempt.
This style of 2FA improves on authenticator apps in two ways: Acknowledging the prompt is slightly more convenient than typing in a code, and it is somewhat more resistant to phishing. With SMS and authenticator apps, a phishing site can simply ask for your code in addition to your password, and pass that code along to the legitimate site when logging in as you. Because push-based 2FA generally displays an estimated location based on the IP address from which a login was originated, and most phishing attacks don’t happen to be operated from the same IP address ranges as their victims, you may be able to spot a phishing attack in progress by noticing that the estimated location differs from your actual location. However, this requires that you pay close attention to a subtle security indicator. And since location is only estimated, it’s tempting to ignore any anomalies. So the additional phishing protection provided by push-based 2FA is limited.ADVERTISEMENT
Disadvantages of push-based 2FA: It’s not standardized, so you can’t choose from a variety of authenticator apps, and can’t consolidate all your push-based credentials in a single app. Also, it requires a working data connection on your phone, while Authenticator apps don’t require any connection, and SMS can work on an SMS-only phone plane (or in poor signal areas).
FIDO U2F / Security Keys
Universal Second Factor (U2F) is a relatively new style of 2FA, typically using small USB, NFC or Bluetooth Low Energy (BTLE) devices often called “security keys.” To set it up on a site, you register your U2F device. On subsequent logins, the site will prompt you to connect your device and tap it to allow the login.
Like push-based 2FA, this means you don’t have to type any codes. Under the hood, the U2F device recognizes the site you are on and responds with a code (a signed challenge) that is specific to that site. This means that U2F has a very important advantage over the other 2FA methods: It is actually phishing-proof, because the browser includes the site name when talking to the U2F device, and the U2F device won’t respond to sites it hasn’t been registered to. U2F is also well-designed from a privacy perspective: You can use the same U2F device on multiple sites, but you have a different identity with each site, so they can’t use a single unique device identity for tracking.
The main downsides of U2F are browser support, mobile support, and cost. Right now only Chrome supports U2F, though Firefox is working on an implementation The W3C is working on further standardizing the U2F protocol for the web which should lead to further adoption. Additionally, mobile support is challenging, because most U2F devices use USB.
There are a handful of U2F devices that work with mobile phones over NFC and BTLE. NFC is supported only on Android. On iOS, Apple does not currently allow apps to interact with the NFC hardware, which prevents effective use of NFC U2F. BTLE is much less desirable because a BTLE U2F device requires a battery, and the pairing experience is less intuitive that tapping an NFC device. However, poor mobile support doesn’t mean that using U2F prevents you from logging in on mobile. Most sites that support U2F also support TOTP and backup codes. You can log in once on your mobile device using one of those options, while using your phishing-proof U2F device for logins on the desktop. This is particularly effective for mobile sites and apps that only require you to log in once, and keep you logged in.
Bonus: Backup Codes
Sites will often give you a set of ten backup codes to print out and use in case your phone is dead or you lose your security key. Hard-copy backup codes are also useful when traveling, or in other situations where your phone may not have signal or reliable charging. No matter which 2FA method you decide is right for you, it’s a good idea to keep these backup codes in a safe place to make sure you don’t get locked out of your account when you need them.
What is the benefit of 2-factor authentication for your business?
- Stronger security Having a second form of identification greatly decreases the chance of a hacker gaining access to corporate devices or other sensitive information.
- Increase productivity and flexibility Many businesses are now embracing remote working as it encourages productivity. 2-factor authentication implementation allows employees to safely access corporate systems from any device or location-without putting sensitive data at risk.
- Lower help desk and security management costsTwo-Factor authentication helps to reduce time-consuming password-resets which help desks are burdened with. 2FA provides a safe way for users to reset their own passwords. The outcome for businesses is increased employee productivity.
- Reduce fraud and build secure online relationshipsIdentity theft is on the rise. This can be extremely damaging to businesses as it can result in a loss of trust and credibility. By introducing two-factor authentication you can help to provide a secure brand experience. This encourages strong ongoing relationships with customers.
Drop your comment
