Two-Factor authentication. Do you use it? A lot of IT professionals don’t use either:
- A password manage, nor
- 2-factor authentication.
It’s surprising to me because 2-factor authentication is becoming more and more widely implemented for web services. Banks in the UK consistently use multi-factor authentication. Most consumers will have already experienced 2-factor (or multi-factor) authentication. Facebook, Google, LinkedIn, Twitter, all offer 2-factor processes.
Multi-factor authentication is just a fancy word for a login process that asks you for more than a password alone.
It is widely recognised that a password is pretty weak . We all abuse passwords, and it is pretty easy to capture another person’s password. For years and years, security researchers have been trying to strengthen online verification processes. Multi-factor is something that has emerged as a practical measure to improve your online resiliency. Emphasis on the word **practical** .
Multi-factor (2-factor, 3-factor, 4-factor…n-factor) authentication provides you with an extra layer of protection on top of password protection that puts multiple layers of access control around your account.
For instance, with 2-factor access enabled on Twitter, when you sign in from a new-device, Twitter asks for:
- Your password, and
- The code (6 digits?) they text to your phone.
An attacker needs to have your password and your phone to get into your Twitter account. It isn’t impossible to get both, but as you add more layers (multi-factor == n-factor authentication), then it becomes progressively more difficult for you to loose control over your account.
The time investment to get set-up with usable 2-factor authentication isn’t much. Just poke around the Account or Security section of a website, and you’ll often find that you can enable 2-factor.
OK…so Donal, it seems like an O.K. idea, but I’m lazy…
Sure, me too.
- Strengthen your passwords by using a password manager. You want a manager that is available on all your devices. I recommend Lastpass.com.
- Focus on enabling 2-factor authentication on websites that are important. Social media platforms, email accounts, password managers. (Physical devices, like your laptop, can also have more than a password.)
- Use Authy. This little device can store all those separate 2-factor tokens into one place. It’s like a password manager, except it is for 2-factor authentication.