User Tools

Site Tools


two-factor_authentication

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
Next revisionBoth sides next revision
two-factor_authentication [2019/08/06 19:59] – neiltwo-factor_authentication [2019/08/21 06:45] – neil
Line 1: Line 1:
 =====Two-factor authentication===== =====Two-factor authentication=====
-====What is "two-factor authentication? ==== 
  
-Different forms of second factor.+====Key points ==== 
 +  * [[two-factor_authentication#"Two-factor authentication" means using something you are, or something you have, to log in to a site, rather than just something you know|"Two-factor authentication" means using something you are, or something you have, to log in to a site, rather than just something you know]] 
 +  * [[two-factor_authentication#Enable two-factor authentication wherever you can|Enable two-factor authentication wherever you can]] 
 +  * [[two-factor_authentication#Have a back-up mechanism in case you lose your device(s)|Have a back-up mechanism in case you lose your device(s)]]
  
-Backup codes.+===="Two-factor authentication" means using something you are, or something you have, to log in to a site, rather than just something you know====
  
-Two hardware devices, so you can store backup safely in safe.+When you log in to site or service using a username and password combination, you are logging in with what is known as a "single factor", since both of these things – your username, and your password — are both "things that you know".
  
-Enable two-factor authentication wherever you canbut make sure you have back-up mechanism in case you lose your device(s).+To increase your security, you need to add additional "factors" to your login credentials. This means thatif someone compromises your username and password (highly likely if you are not [[passwords#Use unique email address, and a unique password, for every site and service|using a unique username, and unique password, for every site and service]], or else if you log in over [[secure_browsing#Check for a padlock, but it doesn't mean you're connecting to the right site|an insecure connection]]), they should still not be able to access your account, since they do not have control over that extra "factor".
  
 +You choices are "things that you are" and "things that you possess".
  
-Option of 2FA — so if you do make mistake and give away your username and password, still hard for someone to make use of them, as they require an extra piece of data which (hopefully) on your can generate+"Things that you are" basically means using [[passwords#Consider if biometric security is right for you|biometric factorsuch as a fingerprint or facial recognition scan]].
  
-Downside of 2FA is that, if you lose your device, you may well be locked out of your accounts+This page focusses on "things that you possess".
  
-If the second code is delivered over SMS, you can probably get new SIMget your provider to move your number across to the new SIM, and you are up and running+====Enable two-factor authentication wherever you can ==== 
 + 
 +Because of the security benefits of having two-factor authentication in place, you should enable it wherever you can. This normally means "on every site and service which supports it". 
 + 
 +Check first that you can use whatever two-factor approach you are using on whatever devices you tend to use. If you primarily use your phone, and the service requires a hardware device which is incompatible with your phoneyou'll be causing yourself a lot of inconvenience, which may overreach the security benefit. 
 + 
 +====Have a back-up mechanism in case you lose your device(s)==== 
 + 
 +A risk of enabling two-factor authentication is that, if you lose control of the second factor, you will be unable to access the service in question. 
 + 
 +===Backup one-time codes === 
 + 
 +If you are using one-time codes, you are usually prompted to download and save some backup codes, which you can use if you lose your one-time code generator. 
 + 
 +If you use password managerand if you back this up, you might store your backup codes in that. 
 + 
 +Alternatively, or perhaps additionally, you might print them off, and store them in a safe. 
 + 
 +===Backup hardware devices === 
 + 
 +If you are using a hardware device, good practice is to buy two identical devices, and configure them to mirror each other.  
 + 
 +Keep one with you, to use for logging in, and keep the second in a safe. 
 + 
 +====Something you have: one-time codes ==== 
 + 
 +Some sites will let you configure your account to require you to put in a one-time code, in addition to your username and password. 
 + 
 +These one-time codes are usually generated by a piece of software on your computer or phone, or else through a dedicated hardware device. 
 + 
 +===Time-based One-Time Passwords (TOTP)=== 
 + 
 +===Avoid text message for delivery of codes === 
 + 
 +Some services offer the real-time delivery of one-time codes using text message. If possible, avoid this, in favour of an approach which doesn't use text messages. 
 + 
 +First, text messages are not secure, and a sufficiently motivated attacker is likely to be able to access your messages. 
 + 
 +Second, if someone manages to hijack your phone number (sometimes known as "SIM swapping")they get all your messages and calls. Irritating at the best of times, but even more problematic if you rely on text messaging to log in to your services — the double whammy of you not being able to log in until you get it fixed, and someone else getting your codes.
  
-If you use an app — which means you are not reliant on getting an SMS — you may struggle more. I don’t have a great solution for this at the moment. 
  
 ====Hardware security tokens ==== ====Hardware security tokens ====
 +{{::img_0417.jpg?400|}}
 Yubikeys Yubikeys
two-factor_authentication.txt · Last modified: 2022/09/08 09:09 by neil