What is 2FA | TechRadar
A username or email address and password can keep your accounts and personal information relatively safe, but the need for more robust security measures has become more obvious over time. Hackers can compromise user accounts in various ways, and our information isn’t always as safe as we’d like to think.
Two-factor authentication is one of the simplest and most effective strategies for improving account security. While 2FA utilization has increased dramatically over the past few years, it’s still far from universal. In this article, we’ll explain how two-factor authentication works and why it’s an excellent way to protect your data.
How does two-factor authentication work?
As the name implies, two-factor authentication introduces a second layer of security to the login process. A username/email address and password are considered a single factor when considered together. This is because usernames and email addresses are often available to others, so the password is the only thing securing the account.
The idea behind two-factor authentication is that it’s far more difficult to compromise both factors than either one individually. For example, your debit card acts as a single factor when withdrawing from an ATM. Asking for a separate PIN number substantially reduces the risk of fraudulent withdrawals—even if someone steals your card, they will still need to identify your PIN in order to get any cash.
Of course, part of what makes two-factor authentication effective is that the factors can’t be compromised in the same way. It wouldn’t be helpful for ATMs to require you to insert your driver’s license along with your debit card if you keep both cards in the same wallet.
Two-factor authentication is therefore described as the combination of two of three elements: something you have (such as your debit card or smartphone), something you know (such as your PIN or password), and something you are (such as a fingerprint or facial scan). Passwords are usually the first factor for online accounts, so the second factor is typically either something the user has or something they are.
With that in mind, 2FA solutions often rely on a second device to authenticate access on the first. For example, when logging into an account on a computer, the platform might send you a text to verify the login attempt. Someone would have to find out your password and steal your phone in order to access the account.
How effective is two-factor authentication?
Do note that while a 2FA system is one of the most powerful methods of increasing your online security, it can’t completely eliminate risks. There are several notable ways that a determined attacker could bypass two-factor authentication in order to access your data.
For example, some users have been targeted by phishing attempts in which the attacker simulates the website they’re trying to access. One of the most common phishing tactics involves sending a false security breach notification in order to create a sense of urgency and make the recipient less wary of potential scams.
In another well-known attacking technique, scammers forward the target’s information to the legitimate site and use it to generate cookies that will allow them to access the account on their own device. The combination of Muraena and NecroBrowser, two popular phishing tools, makes this strategy accessible to almost any user.
Two-factor authentication can also be vulnerable in cases where the user doesn’t have access to the second factor. Traditional account recovery systems simply provide a new password or password reset link, but this practice also gives attackers an opportunity to get around 2FA security.
Of course, this isn’t to say that two-factor authentication is useless or isn’t worth implementing in your business. It’s simply important to note that 2FA isn’t foolproof on its own—it should always be considered one aspect of a broader approach to corporate security.
How can I start using 2FA?
Two-factor authentication options are now available on a wide range of websites, apps, and other services. While there are a few standard providers, such as Duo and Authy, different platforms often have their own 2FA policies.
Facebook, Twitter, and LinkedIn are among the most popular sites that make it easy for users to set up two-factor authentication on their accounts. Two-factor authentication is even more common in business settings.
Many business services now offer 2FA, some even giving admins the option to require it for all accounts in the organization. These are just a few platforms that currently provide support for two-factor authentication:
- Slack
- Microsoft
- Apple
- Dropbox
Duo and Google Authenticator are two accessible options for businesses that want to start using 2FA. Both apps are designed to be used with a variety of services. Duo also provides single sign-on for additional security and enables team admins to control permissions for every user in the organization.
Conclusion
Two-factor authentication plays a critical role in security for businesses, schools, and other organizations around the world, and it’s easy to see why it’s so popular. Setting up 2FA makes it substantially more difficult for attackers to compromise accounts and sensitive information, without requiring users to invest in any additional hardware.
While businesses shouldn’t treat two-factor authentication as a complete solution, it’s one of the simplest ways to immediately improve security. Phishing and other threats are more prevalent than ever, and 2FA will give your company that much more protection against attacks.