NWA-PCUG Newsletter Article, December 2012
Two-Factor Authentication
By Bob Rankin, Ask Bob Rankin.
From Rankinís August 15, 2012 newsletter, reprinted with permission


From Rankinís August 15, 2012 newsletter, reprinted with permission

Okay, I'll admit this sounds geeky, but itís important. Two-factor login security isnít all that complicated, and it can save your bacon from hackers and identity thieves. Read on to learn more about this relatively new security technique that I'm strongly recommending for PC, Mac and mobile users...

What is Two Factor Authentication?
In order to understand two-factor authentication (also called two-step verification) and how it can dramatically improve your online security, itís best to start with familiar examples of one-factor authentication and their vulnerabilities.

Authentication, in security speak, is the process of demonstrating that you have access privileges to some restricted environment. Each piece of proof that you can offer is called a factor. In a one-factor authentication system, only one piece of proof needs to be offered to gain access.

Take your car key: you need only that one authentication factor to open your car. The lock doesnít care who is holding the key. The key works even in the hand of a thief.

The same is true of traditional website logins. A website doesnít care if the person who enters the password is who he or she claims to be. If a thief guesses or otherwise gets hold of your username and password, he can pretend to be you. Thatís relatively easy with keyloggers, phishing emails, and many other tricks.

Yes, a username and a password are two different things, but since the usernames are public knowledge, they donít count as one of your authentication factors. Theyíre also typically stored together and stolen together, so we need something in addition to the username/password as a second security factor.

Now, consider using an ATM. You have a PIN code, but that alone wonít get you any cash. You also need the physical card with its magnetic strip. Someone who steals your card or PIN alone is out of luck. That is a simple example of two-factor authentication. Of course, if you keep your PIN written down on a scrap of paper in your wallet, next to your card, then you are a fool.

Two Out of Three Ain't Bad
Ever wonder if someone is looking over your shoulder while you login to Facebook or Gmail at the coffee shop? It happens. But hereís the really cool thing -- with two-factor authentication, it doesnít matter if someone guesses or steals your password. Let me explain further. Two-factor authentication systems require two out of three things to authenticate you:
1. Something you know: a memorized PIN or password
2. Something you have: an ATM card, smartphone or some other physical token
3. Something you are: a biometric trait such as a fingerprint or retina pattern

Biometrics is used in some highly secured environments, and on some consumer laptops, but they have not caught on among the general public. Physical tokens such as cards or USB dongles are a bit more common. But in general, the public has been too lazy to employ two-factor authentication, even in the face of news stories about hackers gaining access to millions of passwords. However, some high-profile companies are offering simpler approaches that may change that.

What Services Offer Two-Step Verification?
Google offers two-step verification for Gmail and other Google services. If you turn this option for Gmail youíll need to enter your username/password as usual. Youíll then be prompted for an authentication code before the login can be completed. The code comes from Google Authenticator, an app for Android, iOS, and Blackberry devices. This time-sensitive code can be generated even if youíre not online, and you can also print a list of codes for use when you donít have your phone handy. (https://support.google.com/accounts/bin/answer.py?hl=en&topic=1056283&answer=180744&rd=1) http://bit.ly/xg1nKd

Yes, itís a minor nuisance to enter the code. But you only have to do it once every 30 days, or if youíre logging in from an unfamiliar device or location. Just remember the major benefit: even if someone obtains your password, they wonít be able to login to your account without that verification code. And in order to get the code, theyíd also have to steal your mobile phone.

Yahoo offers their version, called second sign-in verification for Yahoo Mail users. (http://www.ymailblog.com/blog/2011/12/yahoo-introduces-stronger-user-authentication-%E2%80%93-second-sign-in-verification/) http://bit.ly/tQRCHz

Facebook recently introduced what it calls login approvals, a process that requires two independent factors to authenticate a user at login. When login approval is activated, you are first asked for your Facebook username and password as usual. Then, Facebook checks to see if you are attempting to log in from an IP address that you use regularly. If not, then Facebook sends a code to your registered mobile device in the form of an SMS message. You have to enter that code in order to log on from an unfamiliar IP address. (http://www.facebook.com/note.php?note_id=10150172618258920) http://on.fb.me/lnfcpg

SpiderOak.com, a cloud storage service like DropBox, offers phone-based two-factor authentication as an option.

Some banks, brokerage houses, and other financial institutions offer (and even require) two-factor authentication in different forms. Bank of Americaís SafePass is one example. If you want the extra security of two-factor authentication from a particular institution, call to see if itís available. (http://www.bankofamerica.com/privacy/index.cfm?template=learn_about_safepass) http://bit.ly/Jep4>

In spite of the extra step required to login, I highly recommend that you turn on two-step verification. whenever itís offered. Youíll be glad you did, every time a friend tells you their email or Facebook account was hacked. Two-factor authentication will probably become a required part of every online login process before long. Youíll be doing yourself a favor by getting on board now.

Click here to return to top