Differences

This shows you the differences between two versions of the page.

--- two-factor_authentication [2019/08/21 06:37] – neil
+++ two-factor_authentication [2019/08/21 06:45] – neil
@@ Line 3: / Line 3: @@
 ====Key points ====
   * [[two-factor_authentication#"Two-factor authentication" means using something you are, or something you have, to log in to a site, rather than just something you know|"Two-factor authentication" means using something you are, or something you have, to log in to a site, rather than just something you know]]
+  * [[two-factor_authentication#Enable two-factor authentication wherever you can|Enable two-factor authentication wherever you can]]
+  * [[two-factor_authentication#Have a back-up mechanism in case you lose your device(s)|Have a back-up mechanism in case you lose your device(s)]]
 ===="Two-factor authentication" means using something you are, or something you have, to log in to a site, rather than just something you know====
@@ Line 19: / Line 21: @@
 Because of the security benefits of having two-factor authentication in place, you should enable it wherever you can. This normally means "on every site and service which supports it".
+Check first that you can use whatever two-factor approach you are using on whatever devices you tend to use. If you primarily use your phone, and the service requires a hardware device which is incompatible with your phone, you'll be causing yourself a lot of inconvenience, which may overreach the security benefit.
 ====Have a back-up mechanism in case you lose your device(s)====
@@ Line 44: / Line 48: @@
 These one-time codes are usually generated by a piece of software on your computer or phone, or else through a dedicated hardware device.
-Backup codes.
+===Time-based One-Time Passwords (TOTP)===
-Two hardware devices, so you can store a backup safely in safe.
+===Avoid text message for delivery of codes ===
-Option of 2FA — so if you do make a mistake and give away your username and password, still hard for someone to make use of them, as they require an extra piece of data which (hopefully) on your can generate.
+Some services offer the real-time delivery of one-time codes using text message. If possible, avoid this, in favour of an approach which doesn't use text messages.
-Downside of 2FA is that, if you lose your device, you may well be locked out of your accounts.
+First, text messages are not secure, and a sufficiently motivated attacker is likely to be able to access your messages.
-If the second code is delivered over SMS, you can probably get a new SIM, get your provider to move your number across to the new SIM, and you are up and running.
+Second, if someone manages to hijack your phone number (sometimes known as "SIM swapping"), they get all your messages and calls. Irritating at the best of times, but even more problematic if you rely on text messaging to log in to your services — the double whammy of you not being able to log in until you get it fixed, and someone else getting your codes.
-If you use an app — which means you are not reliant on getting an SMS — you may struggle more. I don’t have a great solution for this at the moment.
 ====Hardware security tokens ====
 {{::img_0417.jpg?400|}}
 Yubikeys